CVE-2026-82631: Valkey Use-After-Free Vulnerability

CVE-2026-82631 Overview

CVE-2026-82631 is a use-after-free vulnerability [CWE-119] in valkey-io Valkey version 9.1.0. The flaw resides in the handleClientsBlockedOnKey function within src/blocked.c, part of the Blocked-on-keys Subsystem. An attacker can trigger the condition remotely, though successful exploitation is difficult and requires high privileges. A public proof-of-concept exists, and the maintainers have released commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b to address the issue. Operators running Valkey 9.1.0 should apply the upstream patch to prevent memory corruption in the blocking-key notification path.

Critical Impact
A remote attacker with high privileges can trigger a use-after-free condition in the Valkey blocked-on-keys subsystem, potentially leading to process instability or memory corruption on affected servers.

Affected Products

valkey-io Valkey 9.1.0
Valkey deployments using blocking key commands (BLPOP, BRPOP, BLMOVE, XREAD BLOCK, etc.)
Any downstream distribution bundling Valkey 9.1.0 without the fix commit

Discovery Timeline

2026-08-31 - CVE-2026-82631 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82631

Vulnerability Analysis

The vulnerability lives in handleClientsBlockedOnKey in src/blocked.c, which iterates over clients waiting on a key that has become ready. During iteration, a client can be freed while the subsystem still holds a reference to it, producing a classic use-after-free condition [CWE-119].

Exploitation requires a network-reachable Valkey instance and elevated privileges to issue the relevant blocking commands. The attack complexity is high because the attacker must race the client-freeing logic with the ready-key notification path. Impact is limited to availability, typically resulting in a crash or unpredictable server behavior rather than data disclosure.

Root Cause

The handleClientsBlockedOnKey routine dereferenced client structures from the blocking_keys list without re-validating that each entry still corresponded to a live client. When a waiter was invalidated, either through disconnection or through the RM_Call fake-client path, the stale pointer could be reused, corrupting memory managed by the Valkey allocator.

Attack Vector

An authenticated remote client abuses Valkey blocking commands to place itself on a key's waiter list, then forces the client to be released or freed while another operation signals the key as ready. The signaling path then dereferences the stale entry. The attack is remote over the Valkey wire protocol but is described as difficult to reproduce reliably.

     signalKeyAsReadyLogic(db, key, type, 1);
 }
 
+/* Find a waiter for rl->key by client id (real or RM_Call fake clients). */
+static client *getClientFromBlockingKeysList(readyList *rl, uint64_t id) {
+    list *client_list = dictFetchValue(rl->db->blocking_keys, rl->key);
+    listNode *ln;
+    listIter li;
+
+    if (client_list == NULL) return NULL;
+    listRewind(client_list, &li);
+    while ((ln = listNext(&li)) != NULL) {
+        client *c = listNodeValue(ln);
+        if (c->id == id) return c;
+    }
+    return NULL;
+}
+
 /* Helper function for handleClientsBlockedOnKeys(). This function is called
  * whenever a key is ready. we iterate over all the clients blocked on this key
  * and try to re-execute the command (in case the key is still available). */
// Source: [GitHub Commit b2fb0e13](https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b)

The patch introduces getClientFromBlockingKeysList, which resolves a client by its stable id from the current blocking_keys dictionary. This ensures the ready-key handler operates on a currently-registered waiter rather than a cached pointer that may have been freed.

Detection Methods for CVE-2026-82631

Indicators of Compromise

Unexpected crashes or segmentation faults in the valkey-server process, particularly in stack traces referencing handleClientsBlockedOnKey or blocked.c.
AddressSanitizer or Valgrind reports flagging heap-use-after-free in the blocking subsystem.
Repeated abnormal disconnects from authenticated clients issuing BLPOP, BRPOP, BLMOVE, or XREAD BLOCK commands.

Detection Strategies

Inventory all Valkey instances and confirm whether the running binary was built from a commit that predates b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b.
Correlate Valkey error logs and systemd or container restart events with authenticated client activity that uses blocking commands.
Enable core dumps in non-production environments to capture crash context for triage.

Monitoring Recommendations

Alert on valkey-server process restarts, out-of-memory conditions, and unclean shutdowns via infrastructure monitoring.
Track authenticated command volumes for blocking operations against list and stream keys to spot abusive patterns.
Forward Valkey logs to a central store and monitor for the strings SIGSEGV, Assertion failed, or handleClientsBlockedOnKey.

How to Mitigate CVE-2026-82631

Immediate Actions Required

Upgrade Valkey 9.1.0 to a build that includes commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b or a later maintenance release.
Restrict network exposure of Valkey to trusted application tiers using firewall rules or network policies.
Review ACLs to ensure only required users can issue blocking commands, since exploitation requires high privileges.

Patch Information

The upstream fix is available as commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b, merged via GitHub Pull Request #4212. Additional context is tracked in GitHub Issue #4198 and VulDB CVE-2026-82631. Rebuild from the patched source or wait for a tagged release from the Valkey repository.

Workarounds

Require strong authentication and use Valkey ACLs to deny blocking commands to untrusted principals.
Terminate TLS at Valkey and restrict client sources with bind, firewall rules, and mutual TLS where feasible.
Place Valkey behind a proxy or service mesh that can rate-limit or filter blocking commands from suspicious clients.

bash

# Example ACL to remove blocking commands from a limited-role user
valkey-cli ACL SETUSER appreader on >StrongPasswordHere \
  ~app:* +@read +@connection \
  -blpop -brpop -blmove -brpoplpush -xread -xreadgroup

# Verify installed version
valkey-server --version