Description

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T15:16:55.463Z",
  "pubdate": "2026-08-18T15:16:55.463Z",
  "executiveSummary": "A use-after-free vulnerability exists in Valkey, a distributed key-value database, specifically within the TLS connection handling subsystem. The flaw is triggered during the execution of the tlsProcessPendingData function, which improperly iterates over the pending_list while an authenticated client executes a CLIENT KILL command. This interaction results in connTLSClose deleting the iterator's cached next node. Consequently, memory corruption occurs, leading to a denial of service via server crash or potentially facilitating remote code execution. The vulnerability affects systems utilizing TLS configurations where threat actors possess network exposure and authenticated access. Exploitation requires the attacker to issue specific administrative commands while pending TLS data is being processed, forcing unsafe state modifications within memory structures. Remediation requires upgrading Valkey to the officially patched versions where safe iterator management and connection closure routines are enforced.",
  "technicalDetails": "The root cause of the vulnerability resides in memory management errors during concurrent asynchronous operations involving TLS connection teardown and internal list iteration. Specifically, the vulnerable component is the tlsProcessPendingData function, which iterates through the pending_list data structure to process buffered TLS input and output data. During this iteration, an authenticated client with sufficient privileges to issue administrative commands can invoke the CLIENT KILL command against the active connection. When CLIENT KILL executes, it invokes connTLSClose to forcefully terminate and clean up the targeted TLS connection context. The execution of connTLSClose unlinks and frees the underlying connection structures, which inadvertently deletes the cached next node currently referenced by the active iterator inside tlsProcessPendingData. As a result, when the iteration loop attempts to access the subsequent node, it references a memory address that has already been deallocated, generating a classic use-after-free condition. Authentication requirements dictate that the attacker must be an authenticated client capable of executing the CLIENT KILL command. The attack vector is network-exposed, as Valkey instances must have TLS enabled and accept remote client connections. The exploitation flow begins when the victim server processes pending TLS data while simultaneously handling the malicious or coincidental CLIENT KILL command from the authenticated user. The resulting memory corruption crashes the daemon due to segmentation faults or memory access violations. In more sophisticated attack scenarios, precise heap manipulation could potentially allow an adversary to achieve remote code execution by exploiting the dangling pointer to inject and execute arbitrary machine instructions. Affected versions of Valkey include all deployments prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1."
}