CVE-2026-82677: 
Valkey vulnerability analysis and mitigation

CVE-2026-82677 is a double free vulnerability in the Module Timer Subsystem of Valkey 9.1.0, specifically within the moduleTimerHandler() function in src/module.c. The flaw was reported on July 17, 2026, publicly disclosed on August 31, 2026, and a patch was merged on August 3, 2026. Only Valkey version 9.1.0 is listed as affected, though backports were applied to versions 7.2, 8.0, 8.1, 9.0, and 9.1. It carries a CVSS v3.1 base score of 2.4 (Low) and a CVSS v4.0 base score of 1.9 (Low) (GitHub Issue, GitHub Advisory).

The root cause is a double free (CWE-415) in moduleTimerHandler() triggered when a module timer callback invokes ValkeyModule_StopTimer() on its own currently-firing timer. The sequence is: (1) moduleTimerHandler() retrieves the expired ValkeyModuleTimer object from the global Timers radix tree and calls timer->callback(); (2) inside the callback, VM_StopTimer() finds the same timer in the radix tree, removes it, and frees the object; (3) after the callback returns, moduleTimerHandler() still holds the now-stale pointer and unconditionally calls raxRemove() and zfree(timer) again, causing the double free. The vulnerability is classified under CWE-415 (Double Free) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). A public proof-of-concept module (timer_selfstop_uaf.c) and PoC zip were attached to the GitHub issue, and the bug is reproducible under AddressSanitizer with a confirmed abort (GitHub Issue, GitHub PR).

Successful exploitation causes a process-level crash of valkey-server, resulting in a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not enable data exfiltration or unauthorized data modification. Exploitation requires an authenticated user with high privileges (e.g., the ability to load and interact with a custom Valkey module), significantly limiting the attack surface (GitHub Issue, GitHub Advisory).

A proof-of-concept exploit (PoC.zip) was publicly disclosed alongside the vulnerability report on GitHub, and NVD's SSVC assessment classifies exploitation status as "poc" (GitHub Issue). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.0029 (0.29%), reflecting low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires high privileges and user interaction, making mass exploitation unlikely (GitHub Advisory).

1. Gain privileged access: Obtain authenticated access to a Valkey 9.1.0 instance with sufficient privileges to load a custom module (typically requires administrator-level credentials or direct server access).
2. Compile the malicious module: Build a shared library (e.g., timer_selfstop_uaf.so) containing a timer callback that calls ValkeyModule_StopTimer() on its own timer ID — the exact pattern demonstrated in the public PoC.
3. Load the module: Start or reconfigure the Valkey server to load the malicious module: ./valkey-server --port 6411 --loadmodule /tmp/timer_selfstop_uaf.so.
4. Arm the self-stopping timer: Issue the custom command (e.g., selfstop.arm) via valkey-cli to register a timer that will call ValkeyModule_StopTimer() on itself when it fires.
5. Trigger the double free: Wait for the timer to expire. moduleTimerHandler() invokes the callback, which frees the timer object via VM_StopTimer(); the dispatcher then attempts to free the same object again, causing a double free and crashing the server process (GitHub Issue).

• Process: Unexpected crash or abort of the valkey-server process; presence of AddressSanitizer error output referencing moduleTimerHandler and VM_StopTimer in server logs.
• Logs: Server crash logs or core dumps with stack traces showing a double free originating from moduleTimerHandler() in src/module.c and VM_StopTimer() in src/module.c; ASan messages referencing malloc_usable_size for an already-freed pointer.
• File System: Presence of unexpected .so shared library files loaded as Valkey modules (e.g., files in /tmp or non-standard directories referenced in the server configuration).
• Network: Unusual or custom Valkey commands being issued by a client (e.g., commands not part of the standard Valkey command set, consistent with a loaded exploit module) (GitHub Issue).

Apply the official patch commit b349fe2821e3998534b1454c1b64a478daf8c6b7, which was merged on August 3, 2026, and backported to Valkey versions 7.2, 8.0, 8.1, 9.0, and 9.1 (fixed in releases 8.0.11, 8.1.10, 9.0.6, and 9.1.2). The fix preserves the timer ID before invoking the callback and only frees the timer object if it still maps to the same live entry in the radix tree after the callback returns. As a workaround, restrict network access to Valkey instances to only trusted administrators and prevent untrusted users from loading custom modules (GitHub PR, GitHub Commit).