EUVD-2026-68393
GHSA-vxq6-76gw-j6q5
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires high-privilege authentication and complex race-condition orchestration; impact is limited to server availability with no confidentiality or integrity effect.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue.
AnalysisAI
Use-after-free in Valkey 9.1.0's blocked-on-keys subsystem allows a high-privilege authenticated attacker to crash the server by triggering a reentrant client teardown during ready-key iteration. When a key becomes ready and multiple clients are unblocked simultaneously, a reply callback for the first-served client can invoke CLIENT KILL on a successor client, freeing that client's memory while the iterator in handleClientsBlockedOnKey still holds a reference to it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated access with high privileges (PR:H per the CVSS 4.0 vector) to the Valkey server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L) yields a base score of 1.2, accurately reflecting the narrow impact profile: network-reachable but requiring high attack complexity and high privileges, with only limited availability (server crash/DoS) and no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix by building from a revision that includes commit b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b (https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b), also tracked in PR #4212 (https://github.com/valkey-io/valkey/pull/4212). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today