valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free
CVE-2026-82631 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2026-82631, released September 17, 2026. It is not reported as exploited. Patch Radar priority: Routine.
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| valkey · Debian 13.5 (trixie) | 8.1.1+dfsg1-3+deb13u3 | DEBIAN-CVE-2026-82631 | Sep 17, 2026 |
| valkey · Debian 14 | 9.1.2-1 | DEBIAN-CVE-2026-82631 | Sep 17, 2026 |
| valkey · amzn 2023 | 9.0.6-1.amzn2023.0.1 | ALAS2023-2026-3091 | Sep 28, 2026 |
| valkey-debuginfo · amzn 2023 | 9.0.6-1.amzn2023.0.1 | ALAS2023-2026-3091 | Sep 28, 2026 |
| valkey-debugsource · amzn 2023 | 9.0.6-1.amzn2023.0.1 | ALAS2023-2026-3091 | Sep 28, 2026 |
| valkey-devel · amzn 2023 | 9.0.6-1.amzn2023.0.1 | ALAS2023-2026-3091 | Sep 28, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.