CVE-2026-82677— valkey-io valkey Module Timer module.c moduleTimerHandler double free
Quick assessment
Affected
valkey-io valkey
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 valkey-io 的 Valkey 9.1.0 版本中发现了一个漏洞。该漏洞影响的是模块定时器子系统（Module Timer Subsystem）中 文件里的 函数。该操作会导致“双重释放”（double free）问题。此漏洞可被远程触发。该漏洞的利用方式已公开披露，因此可能被利用。补丁名称为：b349fe2821e3998534b1454c1b64a478daf8c6b7。建议部署该补丁以修复此问题。
Possible ATT&CK Techniques 2 AI
T1041 · Exfiltration Over C2 Channel T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82677
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
valkey-io valkey Module Timer module.c moduleTimerHandler double free
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
双重释放
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82677
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82677
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82677 (2)
Other References for CVE-2026-82677 (5)
-
-
-
🔗 CVE-2026-82677 in valkey third-party-advisory
-
🔗 Submit #893959: Valkey Project Valkey 9.1.0 Double Free third-party-advisory
-
🔗 CVE-2026-82677 valkey-io valkey Module Timer module.c moduleTimerHandler double free vdb-entry technical-description
Other References for CVE-2026-82677 (1)
IV. Related Vulnerabilities
Same product: valkey
-
CVE-2026-82631
valkey-io valkey Blocked-on-keys blocked.c handleClientsBloc -
CVE-2026-63639
Valkey: UAF in stream deserialization may lead to remote cod -
CVE-2026-56684
Valkey: TLS pending-data processing use-after-free may allow -
CVE-2026-27623
Valkey has Pre-Authentication DOS from malformed RESP reques -
CVE-2026-21863
Malformed Valkey Cluster bus message can lead to Remote DoS
Same vendor: valkey-io
-
CVE-2026-82631
valkey-io valkey Blocked-on-keys blocked.c handleClientsBloc -
CVE-2026-63639
Valkey: UAF in stream deserialization may lead to remote cod -
CVE-2026-56684
Valkey: TLS pending-data processing use-after-free may allow -
CVE-2026-21864
Remote DoS from malformed RESTORE command -
CVE-2026-27623
Valkey has Pre-Authentication DOS from malformed RESP reques
Same weakness: CWE-415
-
CVE-2026-19316
Fireware OS Pre-Authentication Double Free in iked Allows De -
CVE-2026-75159
MongoDB BI Connector Improper Memory Handling During Failed -
CVE-2026-18798
QUIC Server May Trigger Double Free When Processing INITIAL -
CVE-2026-47895
strongswan 资源管理错误漏洞 -
CVE-2026-45202
GPU DDK - Silent High-Order CMA Memory Leak & Double Free in
V. Comments for CVE-2026-82677
No comments yet