CyberRota Analysis
AI-GeneratedValkey's tlsProcessPendingData function is vulnerable to a use-after-free condition due to improper handling of the pending_list, which can be exploited by an authenticated client to crash the server or potentially execute remote code when TLS is enabled. Organizations using versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 should prioritize upgrading to mitigate the risk of exploitation. This vulnerability poses a significant threat to the integrity and availability of systems utilizing the affected database.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.