CVE-2026-82677

A flaw was found in valkey-io valkey. A remote attacker could exploit a double free vulnerability in the moduleTimerHandler function within the Module Timer subsystem (src/module.c). This flaw could lead to a denial of service.

A double-free vulnerability in the Module Timer subsystem (moduleTimerHandler in src/module.c) of Valkey allows remote, highly privileged authenticated attackers to trigger a denial of service (daemon crash) by manipulating module timers. Execution remains confined within the process runtime environment, mitigated by default SELinux policies and container isolation preventing host-level escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict access to high-privilege administrative users capable of executing module timer operations, or isolate the Valkey service using network firewalls and RBAC controls until fixed packages are installed.