Valkey EUVD-2026-60822

Valkey (CPE: cpe:2.3:a:valkey-io:valkey) is an open-source distributed key-value store and actively maintained Redis fork. The vulnerability resides in src/tls.c within the tlsProcessPendingData function, which iterates over a pending_list of TLS connections awaiting I/O processing using a standard listIter. The iterator caches a pointer to the next list node at the start of each loop step. When an authenticated client issues a CLIENT KILL command targeting a concurrently iterated connection, the resulting internal call chain - freeClient → connTLSClose → listDelNode - frees the very node the iterator has cached, leaving a dangling pointer. CWE-416 (Use After Free) is the confirmed root cause class: subsequent dereference of the freed pointer produces either a server crash or, under controlled heap-layout conditions, arbitrary code execution. The fix in PR #4234 (commit 7cd5bcb) replaces the iterator with a pop-then-process loop that captures the list length at entry to bound iterations and re-appends deferred connections to the tail, eliminating the dangling-pointer window entirely.