CVE-2026-82677
Description
A flaw was found in valkey-io valkey. A remote attacker could exploit a double free vulnerability in the moduleTimerHandler function within the Module Timer subsystem (src/module.c). This flaw could lead to a denial of service.
Statement
A double-free vulnerability in the Module Timer subsystem (moduleTimerHandler in src/module.c) of Valkey allows remote, highly privileged authenticated attackers to trigger a denial of service (daemon crash) by manipulating module timers. Execution remains confined within the process runtime environment, mitigated by default SELinux policies and container isolation preventing host-level escalation.
Mitigation
Restrict access to high-privilege administrative users capable of executing module timer operations, or isolate the Valkey service using network firewalls and RBAC controls until fixed packages are installed.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.9 | N/A | 2.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
