Description

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.2",
  "pubDate": "2026-08-31T08:17:03.877Z",
  "pubdate": "2026-08-31T08:17:03.877Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists in the Blocked-on-keys subsystem of Valkey version 9.1.0.\nThe flaw specifically resides within the handleClientsBlockedOnKey function in src/blocked.c.\nThe vulnerability allows a remote attacker to trigger memory corruption, potentially leading to arbitrary code execution or service disruption.\nExploitation is characterized by high complexity and difficulty, yet public exploit code exists, increasing the risk for production environments.\nThe vulnerability affects system stability and memory integrity, requiring immediate attention to prevent potential system compromise.\nAdministrators are urged to apply the identified patch to remediate the underlying memory management defect.",
  "technicalDetails": "The vulnerability is a Use-After-Free condition occurring during the processing of clients blocked on specific keys. The handleClientsBlockedOnKey function in src/blocked.c fails to properly manage the lifecycle of client objects when handling blocked key transitions.\nRoot Cause Analysis: The issue stems from a flaw in the reference counting or lifecycle management logic within the blocked-on-keys subsystem. When a client is removed from the wait queue and processed, the internal state transition logic permits the client object to be freed while a pointer to that object remains in active use or is subsequently accessed during the resolution of other blocked clients.\nAttack Flow: An attacker initiates a remote connection to the Valkey instance. By sending a sequence of specific commands designed to trigger blocking operations (e.g., BLPOP, BRPOP, or other blocking primitives), the attacker forces the server to place the client in a wait state. The attacker then manipulates the key-space or connection state to trigger a race condition or an improper cleanup sequence within handleClientsBlockedOnKey. As the subsystem attempts to process the blocked client list, it accesses the previously deallocated memory region.\nExploitation Dynamics: While the exploit is classified as high complexity and difficult to execute, it remains a critical threat. The exploit utilizes the UAF to potentially gain control over the instruction pointer or corrupt adjacent heap structures. Successful exploitation depends on the attacker's ability to groom the heap and replace the freed memory with attacker-controlled data before the secondary access occurs.\nImpact: Because the defect occurs within the core subsystem responsible for blocking operations, it can lead to server crashes (Denial of Service), memory leaks, or, if successfully leveraged, remote code execution. The vulnerability is network-accessible, meaning that any entity capable of reaching the Valkey port can theoretically trigger the condition if the required command sequence is executed.\nAffected Component: The Blocked-on-keys subsystem in Valkey 9.1.0, specifically the handleClientsBlockedOnKey function in src/blocked.c."
}