CVE-2026-82631: Use After Free in valkey-io valkey

This vulnerability involves a use-after-free condition in the handleClientsBlockedOnKey function of the src/blocked.c file in valkey-io valkey 9.1.0. The issue allows remote attackers with high privileges to exploit the flaw, although the attack complexity is high and no user interaction is required. The vulnerability has a low CVSS 4.0 score of 2.1, reflecting limited impact and exploitability. Public exploit code has been released. A patch commit (b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b) is available to fix the issue.

The vulnerability allows remote attackers with high privileges to trigger a use-after-free condition, which could potentially lead to limited impact such as low-level memory corruption. The CVSS score of 2.1 indicates low severity, and no user interaction is needed. Although exploit code is publicly available, the attack complexity is high, reducing the likelihood of widespread exploitation.

A patch identified by commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b is available and should be applied to resolve this vulnerability. Since the vendor advisory or remediation level is not explicitly stated, applying this patch is the recommended mitigation. No other vendor-provided mitigations or workarounds are noted.