Low severity · published Aug 31, 2026
CVE-2026-82631
valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
2.2
CVSS
0.6%
EPSS
No
On KEV
Description
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
valkey · valkey-io
9.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82631
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82631
github.com
https://github.com/user-attachments/files/30111628/PoC.zip
github.com
https://github.com/valkey-io/valkey/
github.com
https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b
github.com
https://github.com/valkey-io/valkey/issues/4198
github.com
https://github.com/valkey-io/valkey/pull/4212
vuldb.com
https://vuldb.com/cve/CVE-2026-82631
More from valkey
8.8
CVE-2026-63639
Valkey: UAF in stream deserialization may lead to remote code execution
7.5
CVE-2026-56684
Valkey: TLS pending-data processing use-after-free may allow remote code execution
7.5
CVE-2026-27623
Valkey has Pre-Authentication DOS from malformed RESP request
7.5
CVE-2026-21863
Malformed Valkey Cluster bus message can lead to Remote DoS
7.1
CVE-2025-67733
Valkey Affected by RESP Protocol Injection via Lua error_reply
