A vulnerability was determined in valkey-io valkey 9.1.0. (CVE-2026-82677)

CVE-2026-82677 describes a double free vulnerability in the function moduleTimerHandler within src/module.c of the Module Timer Subsystem component in valkey-io valkey version 9.1.0. The vulnerability allows remote attackers to cause a double free condition, which can lead to application instability or denial of service. The vulnerability has been publicly disclosed, and a patch identified by commit b349fe2821e3998534b1454c1b64a478daf8c6b7 is recommended for remediation. The CVSS v3.1 base score is 2.4, indicating low severity with network attack vector, low complexity, high privileges required, and user interaction needed. No known exploits in the wild have been reported.

The vulnerability can be exploited remotely to cause a double free condition, potentially leading to denial of service by crashing the application or corrupting memory. There is no confidentiality or integrity impact reported. The overall severity is low.

A patch is recommended to fix this vulnerability. The patch is identified by commit b349fe2821e3998534b1454c1b64a478daf8c6b7. Users of valkey-io valkey 9.1.0 should apply this patch to remediate the issue. No vendor advisory or official fix status is provided, so check the vendor's resources for the patch availability and installation instructions.