CVE-2026-82631

Executive Summary

CVE-2026-82631 is a use-after-free vulnerability in Valkey 9.1.0, specifically located in the handleClientsBlockedOnKey function within src/blocked.c of the Blocked-on-keys Subsystem. An attacker with high privileges can exploit this flaw remotely to trigger a use-after-free condition, potentially causing a denial of service via memory corruption. The vulnerability has a CVSS score of 2.2 (Low severity), reflecting the high attack complexity and high privilege requirements; however, the public availability of exploit details increases the urgency of applying the referenced patch. All enterprise deployments running Valkey 9.1.0 with blocked-key operations exposed to authenticated remote users are at risk.

Technical Analysis

The vulnerability resides in Valkey's blocked-key subsystem, which manages clients that have issued commands requiring the server to delay a response until a specific key becomes available (e.g., blocking list operations such as BLPOP or blocking stream reads). The affected function, handleClientsBlockedOnKey, is responsible for processing the queue of clients blocked on a given key and determining which of them should be unblocked and served when the key receives new data.

The flaw is a classic use-after-free (CWE-119, Memory Safety) condition. During the execution of handleClientsBlockedOnKey, the code retrieves a client object from the blocked-keys queue, processes it, and potentially removes it from the list. Under specific timing conditions — involving concurrent state changes, repeated blocking, or certain command interleavings — a freed client object may still be referenced after its memory has been released. Subsequent reads or writes through the dangling pointer can corrupt the heap, leading to an assertion failure, segmentation fault, or service crash.

Key technical details:

• Affected component: Blocked-on-keys Subsystem, file src/blocked.c
• Affected function: handleClientsBlockedOnKey
• Attack vector: Network (remote), requiring the attacker to be authenticated and able to issue commands that trigger block/unblock cycles
• Complexity: High — the precise timing and state conditions required to reliably trigger the use-after-free are difficult to reproduce, making exploitation nontrivial
• Impact: Primarily availability (CVSS A:L); no confidentiality or integrity impact indicated in the CVSS vector

The public release of exploit details (noted in the NVD description) suggests that at least one working exploitation path has been developed, lowering the practical barrier to attack despite the high complexity rating. The patch is identified by commit hash b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b; however, none of the tracked sources (NVD, vendor advisories, OSV) currently confirm that this patch has been incorporated into a released version, resulting in a Patch Confidence of 0/4.

Exploitation Scenarios

Prerequisites: The attacker must have valid credentials with permission to issue blocking commands, or must be able to leverage another authenticated service that forwards commands to Valkey. The attack is remote but requires a pre-existing authenticated session.

Attack chain (inferred from vulnerability class; no public PoC details available):

1. Reconnaissance/target identification: The attacker identifies a Valkey 9.1.0 server exposed on the network (default port 6379). Using authentication credentials (obtained via other means), the attacker connects to the target. Shodan dorks such as product:valkey, port:6379 valkey, or "valkey" "redis" server can be used to discover exposed instances.

2. Triggering the flaw: With prior knowledge of the use-after-free in handleClientsBlockedOnKey (informed by the public exploit details referenced in the NVD description), the attacker issues a sequence of blocking commands (e.g., BLPOP on a key) followed by non-blocking write operations on the same key, causing clients to be unblocked and processed. By manipulating the order and timing of these operations — likely involving multiple clients on the same key, timeout expirations, and immediate re-blocking — the attacker induces a state where a client object is freed while still referenced by the blocked-key queue.

3. Payload/execution method: At the vulnerability-class level, the use-after-free is triggered when the code path in handleClientsBlockedOnKey accesses a client pointer after the corresponding client object has been deallocated. The attacker controls the number of blocked clients and the timing of key-triggering writes, thereby controlling when the stale pointer is dereferenced. Since the CVSS vector shows no confidentiality or integrity impact, the most likely outcome is a controlled crash (segmentation fault) of the Valkey server process.

4. Post-exploitation impact: A successful exploit results in a denial-of-service condition — the Valkey server crashes and becomes unavailable. If the server is running in a single-master configuration without automatic failover, all data-access operations are interrupted until manual restart. If the server is configured as a primary with replicas, the replicas may experience replication lag or failover, and the primary will need to be restarted. Data loss is unlikely (no integrity impact); the primary concern is service disruption. Given the high attack complexity, sustained exploitation to cause frequent crashes would require repeated authentication and careful timing per attempt.

Note: No public PoC or weaponized exploit code is available (PoC/Exploit: None); the attack chain above is inferred from the vulnerability class and the stated exploitability characteristics in the NVD description. Insufficient technical detail is available to specify the exact command sequence required to trigger the flaw.

Impact Assessment

Business impact: The primary impact is a denial-of-service condition affecting Valkey servers. Organizations using Valkey 9.1.0 as a caching layer, session store, message broker, or primary data store will experience service interruption if the vulnerability is exploited. For high-availability architectures relying on Valkey, the crash of a primary node could trigger failover events, potentially causing cascading load on replicas or downstream services.

Affected systems: Valkey 9.1.0 only (per NVD description). OSV data confirms the affected package is Valkey (package path / with the vulnerable version range c9e8005e9d0ec817e26c7db318861cb821409249→unfixed). Deployments where the blocked-keys subsystem is exposed to authenticated network clients are vulnerable; servers in trusted networks with restricted access are at lower practical risk.

Blast radius: Limited to the Valkey server process itself. No evidence of remote code execution or data exfiltration (CVSS C:N, I:N). The attack requires high-privilege access (PR:H) and has high attack complexity (AC:H), constrain-ing the population of attackers who can successfully exploit it. The CVSS base score of 2.2 (Low) reflects this limited impact, though the public availability of exploit details increases the likelihood of attempted attacks.

EPSS context: The EPSS score of 0.00358 (28.8% percentile) indicates a low probability of exploitation in the wild within the next 30 days. However, this score is probabilistic and does not discount the risk for organizations with high-value Valkey deployments or those exposed to the public internet.

Detection Guidance

Sigma Rule

title: Valkey Use-After-Free - Blocked-Key Subsystem Crash
id: 3f7a9c2d-5e8b-4a1f-9d3c-8b2e6f1a4d50
status: experimental
description: Detects Valkey server crashes potentially caused by exploitation of CVE-2026-82631, a use-after-free in handleClientsBlockedOnKey.
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: application
    product: valkey
    service: server
detection:
    selection_crash:
        EventID: 'CRASH'
        Message|contains:
            - 'Segmentation fault'
            - '*** Aborted ***'
            - 'double free or corruption'
        ProcessName|contains: 'valkey-server'
    selection_blocked_key:
        EventID: 'INFO'
        Message|contains|all:
            - 'blocked keys'
            - 'clients'
        Message|contains:
            - 'Invalid argument'
            - 'Assertion'
    condition: selection_crash OR selection_blocked_key
    timeframe: 5m
level: medium
falsepositives:
    - Legitimate crash caused by hardware faults or memory pressure
    - Assertion failures from unrelated bugs
fields:
    - ProcessName
    - ProcessID
    - username
    - Message

YARA Rule

rule Valkey_BlockedKey_UseAfterFree_Strings
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Valkey binary or memory artifacts containing strings related to handleClientsBlockedOnKey use-after-free"
        cve = "CVE-2026-82631"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $func_name = "handleClientsBlockedOnKey" ascii wide
        $src_file = "blocked.c" ascii wide
        $blocked_subsystem = "blocked-on-keys" ascii wide nocase
    condition:
        (uint16(0) == 0x457f and filesize > 500KB and 2 of ($func_name, $src_file)) or
        (1 of ($func_name, $blocked_subsystem) and 1 of ($src_file, $blocked_subsystem))
}

Suricata IDS Rule

alert tcp any any -> any 6379 (msg:"VALKEY Potential CVE-2026-82631 Use-After-Free Exploitation Attempt"; flow:to_server,established; content:"BLPOP"; nocase; pcre:"/BLPOP\s+[^\r\n]+/i"; threshold:type both, track by_src, count 10, seconds 60; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-82631; sid:10082631; rev:1;)

Elastic Detection

sequence by process.pid with maxspan=5m
  [ process where event.action == "exec" and process.name == "valkey-server" ]
  [ process where event.action == "end" and process.name == "valkey-server"
      and process.exit_code != 0
      and not stringContains(process.command_line, "config-aof-rewrite") ]
  [ file where event.action == "open" and file.path : "*valkey*.log"
      and file.text_content : "*segmentation fault*" or file.text_content : "*assertion*" ]

Splunk SPL Query

index=valkey sourcetype=valkey_logs 
  ( (error OR crash) AND ( "handleClientsBlockedOnKey" OR "blocked.c" OR "double free" OR "segmentation fault" OR "Aborted" ) )
  OR 
  ( (level=WARN OR level=ERROR) AND ( "blocked clients" OR "unblock" OR "key*timeout" ) AND ( "assert" OR "assertion" OR "invalid pointer" ) )
| stats count by host, source, _time, Message
| where count > 3
| sort - _time
| eval risk_score = case( 
    searchmatch("segmentation fault") OR searchmatch("double free"), "CRITICAL",
    searchmatch("assertion") OR searchmatch("invalid pointer"), "HIGH",
    true(), "MEDIUM"
  )

Wazuh OSSEC Rule

<group name="valkey,">
  <rule id="236610" level="10">
    <decoded_as>syslog</decoded_as>
    <program_name>valkey-server</program_name>
    <match>Segmentation fault|Aborted|double free|assertion.*blocked</match>
    <description>Valkey server crash - possible CVE-2026-82631 use-after-free exploitation (handleClientsBlockedOnKey)</description>
    <group>memory_error,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>

  <rule id="236611" level="6">
    <decoded_as>syslog</decoded_as>
    <program_name>valkey-server</program_name>
    <match>blocked_keys|unblock.*error|client.*freed</match>
    <description>Valkey blocked-keys subsystem anomaly - monitor for CVE-2026-82631 attempts</description>
    <group>memory_error,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>

  <rule id="236612" level="4">
    <decoded_as>syslog</decoded_as>
    <program_name>valkey-server</program_name>
    <match>blocked clients|watchdog</match>
    <description>Valkey blocked-key activity detected - check for anomalies</description>
    <group>memory_error,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Detection guidance note: The above rules are heuristic detections based on crash signatures and abnormal blocked-key activity. They are not specific to the exact trigger sequence of CVE-2026-82631, as insufficient technical detail is available to define precise behavioral indicators. Security teams should correlate these detections with network-level signals (e.g., unusual blocking-command patterns) and privilege-context anomalies.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — While the NVD description references patch commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b, no tracked source confirms that this patch has been incorporated into an official release or that it is publicly available for deployment. Treat this vulnerability as currently unpatched in released versions.

1) Immediate mitigations (apply now):

• Restrict network access: Limit Valkey to trusted networks only. Use firewalls or security groups to block port 6379 (and any custom Valkey ports) from untrusted IP ranges. If Valkey must be exposed, require TLS (via stunnel or similar) and restrict source IPs.
• Enforce strong authentication: Ensure Valkey requirepass is set with a strong, unique password. Use ACLs (available since Valkey 7, inherited from Redis) to restrict users to only the commands they need, and explicitly deny blocking commands (BLPOP, BLMOVE, BRPOP, BRPOPLPUSH, XREAD BLOCK, SUBSCRIBE) for accounts that do not require them.
• Disable blocking commands: Where application architecture permits, rename or disable blocking command categories via ACL SETUSER or by renaming commands in valkey.conf (e.g., rename-command BLPOP ""). This prevents the vulnerable code path from being reached.
• Monitor for crashes: Implement the detection rules above to receive alerts on server crashes or blocked-keys subsystem anomalies. Configure Valkey logfile to capture full error output on crash for forensics.
• Deploy an external restarter/watchdog: Use a process supervisor (systemd, supervisord) with automatic restart to minimize downtime windows if a crash occurs.

2) Patch/upgrade steps:

• Monitor the official Valkey GitHub repository (github.com/valkey-io/valkey) and release announcements for a version incorporating commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b.
• Once a patched version (likely 9.1.1 or later) is released, test it in a staging environment, validating blocked-key operations and replication behavior.
• Perform a rolling upgrade: upgrade replicas first, promote a patched replica to primary, then upgrade the old primary.
• Verify the upgrade by confirming the server build includes the patch commit hash (valkey-server --version or INFO server).

3) Long-term hardening:

• Architecture: Avoid exposing Valkey directly to application-facing networks. Place it behind a service mesh or API gateway that handles authentication and access control.
• Segregation: Isolate Valkey servers from general-purpose compute, with dedicated network segments to reduce lateral movement risk.
• Monitoring: Instrument Valkey with metrics (e.g., blocked-clients count, memory fragmentation ratio, crash counters) and alert on anomalies. Feed Valkey logs into SIEM for correlation with authentication events.
• Update policy: Establish a process to track Valkey releases and security advisories. Subscribe to the Valkey GitHub Watch notifications and any mailing lists.
• Redundancy: Run Valkey in a replicated or cluster topology with automatic failover (e.g., Sentinel) to ensure that a crashed node does not cause full service loss.
• Capability review: Regularly audit ACLs to ensure least-privilege access — specifically validate that no production service holds blocking-command permissions unnecessarily.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82631 — Official NVD record with vulnerability description, CVSS vector (2.2), and CWE classification (CWE-119).
2. Valkey GitHub Repository: https://github.com/valkey-io/valkey — Reference location for source code and the patch commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b (once made public); monitor for release announcements.
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-82631 is not listed (verified NO), but should be re-checked periodically given public exploit details exist.
4. FIRST EPSS: https://www.first.org/epss/ — Reference for EPSS score 0.00358 (28.8% percentile) associated with this CVE, indicating low near-term exploitation likelihood.
5. Valkey Documentation (Security & ACLs): https://valkey.io/topics/security/ — Reference for ACL configuration and command restrictions that serve as immediate mitigations.

Threat actor campaign evidence: There is no documented threat actor campaign or observed exploitation-in-the-wild evidence for CVE-2026-82631 as of this report date. The NVD description states that the exploit has been "released to the public," meaning exploit details are available on public forums or repositories, but no operational campaign using this CVE has been identified. The CISA KEV status is NO, confirming no government-verified active exploitation. Organizations should nonetheless prioritize patching given the public exploit availability, even though the EPSS score suggests limited near-term active exploitation.