CVE-2026-82677: 
Redis vulnerability analysis and mitigation

CVE-2026-82677 is a double free vulnerability in the Module Timer Subsystem of Valkey 9.1.0, specifically within the moduleTimerHandler() function in src/module.c. The flaw occurs when a module timer callback invokes ValkeyModule_StopTimer() on its own currently-firing timer, causing the timer object to be freed twice — once inside the callback and again by the dispatcher after the callback returns. The vulnerability was reported on July 17, 2026, publicly disclosed on August 31, 2026, and affects only Valkey version 9.1.0. It carries a CVSS v3.1 base score of 2.4 (Low) and a CVSS v4.0 base score of 1.9 (Low) (GitHub Advisory, Valkey Issue).

The root cause is classified as CWE-415 (Double Free) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). In moduleTimerHandler(), when a timer expires, the dispatcher fetches the ValkeyModuleTimer object from the global Timers radix tree and invokes the timer's callback. If the callback calls ValkeyModule_StopTimer() on the same timer ID, VM_StopTimer() legally removes the entry from the radix tree and frees the timer object. Upon callback return, moduleTimerHandler() holds a now-stale pointer and unconditionally performs a second raxRemove() and zfree() on the already-freed object, triggering the double free. Exploitation requires network access, high privileges (an authenticated user who can load or interact with a malicious module), and user interaction, making it a low-severity but reproducible denial-of-service condition. A public PoC (PoC.zip) and detailed ASan/GDB traces were included in the original issue report (Valkey Issue, Valkey PR).

Successful exploitation causes a reproducible crash (abort) of the valkey-server process, resulting in a denial of service. There is no confidentiality or integrity impact — the vulnerability only affects availability, and only at the process level. Because Valkey is typically used as a caching or real-time data store, a crash could disrupt dependent applications, but lateral movement or data exfiltration are not possible through this vulnerability (Valkey Issue, GitHub Advisory).

A proof-of-concept (PoC.zip) was publicly disclosed alongside the original issue report, demonstrating a reproducible server crash under AddressSanitizer. The EPSS score is approximately 0.0029 (0.29%), indicating low probability of widespread exploitation. The NVD SSVC assessment classifies exploitation as "poc" and automation as "no," meaning exploitation is not trivially automated. There is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Valkey Issue, GitHub Advisory).

1. Prerequisite: Obtain high-privilege authenticated access to a Valkey 9.1.0 instance that has the module API enabled and can load custom modules.
2. Craft a malicious module: Write a Valkey module (.so file) that registers a command (e.g., selfstop.arm) which creates a timer via ValkeyModule_CreateTimer() and stores the returned timer ID in the callback's data structure.
3. Implement a self-stopping callback: In the timer callback (selfstop_cb), call ValkeyModule_StopTimer(ctx, stored_id, NULL) using the same timer ID that is currently firing, causing VM_StopTimer() to free the timer object from within the callback.
4. Load the module: Start or reconfigure the Valkey server to load the malicious module: ./valkey-server --port 6411 --loadmodule /tmp/timer_selfstop_uaf.so.
5. Trigger the vulnerability: Connect with valkey-cli and invoke the module command: ./valkey-cli -p 6411 selfstop.arm. This arms the timer.
6. Wait for timer expiry: When the timer fires, moduleTimerHandler() invokes the callback, which frees the timer object; the dispatcher then attempts a second free, causing a double free and crashing the server process (Valkey Issue).

• Process: Unexpected crash or abort of the valkey-server process; core dump files generated in the working directory.
• Logs: ASan output containing ERROR: AddressSanitizer: attempting to call malloc_usable_size() for pointer which is not owned referencing moduleTimerHandler in src/module.c; server log entries showing abnormal termination or SIGABRT.
• File System: Presence of unexpected .so module files loaded into the Valkey server (e.g., files in /tmp/ referenced by --loadmodule arguments); core dump files (e.g., core.*) in the server's working directory.
• Network: Unusual commands sent to the Valkey port from authenticated clients that invoke custom module commands not part of the standard Valkey command set (Valkey Issue).

Apply the official patch commit b349fe2821e3998534b1454c1b64a478daf8c6b7, which was merged on August 3, 2026, and backported to Valkey 7.2, 8.0, 8.1, 9.0, and 9.1 branches. The fix preserves the timer ID before invoking the callback and re-checks whether the timer ID still maps to the same live object in the Timers radix tree before performing cleanup, preventing the double free. As a workaround, restrict network access to Valkey instances to only trusted administrators and implement network segmentation to limit who can reach Valkey services and load modules (Valkey PR, Patch Commit).

The vulnerability was responsibly reported by researcher gff-cw via a detailed GitHub issue on July 17, 2026, including full ASan traces, GDB evidence, and a proposed patch. Valkey maintainer enjoy-binbin reviewed and approved the fix contributed by quanyeyang, merging it on August 3, 2026, with backports across all supported release branches. The fix was noted for inclusion in release notes for Valkey 8.0.11, 8.1.10, 9.0.6, and 9.1.2. No significant broader media coverage or social media discussion was observed beyond the GitHub issue and pull request (Valkey Issue, Valkey PR).