Vulnerabilities

Security fix · GHSA-fq2f-crmw-q97r

Unauthenticated use-after-free of the Lua interpreter state in Valkey (script debugger command cache)

Published Aug 31, 2026 · catalog updated Aug 31, 2026 · Unauthenticated use-after-free of the

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-fq2f-crmw-q97r. A missing EPSS score is not a low risk. Compare Unauthenticated use-after-free of the with the linked advisory before you change production.

Severity

High8.8

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

valkey valkey-server

## Impact An attacker who can run scripting commands can free the Lua interpreter state out from under the script debugger's cached command table, leaving a dangling pointer that is dereferenced on the next debugger command. This yields a reliable crash of the server process, and can be escalated to control of an indirect call by reclaiming the freed heap chunk with attacker-controlled bytes. This issue affects the 9.x line. The defect was introduced when the Lua scripting engine was moved into a Valkey module. The 8.0.x and 8.1.x lines use the previous non-module debugger and are not affected. ## Details in builds the interactive debugger command table once and caches it in a file-scope static, binding the then-current pointer into each command descriptor's context field. The table is never rebuilt or invalidated. recreates the scripting engine, creating the replacement interpreter state before freeing the previous one on the lazyfree thread. Nothing clears the cached command table, so its context is left pointing at a freed chunk. Any subsequent debugger command dereferences it. Because the freed chunk lives on the ordinary allocator heap, it can be reclaimed with attacker-controlled bytes and shaped into a counterfeit interpreter state, at which point the next allocation performed by the interpreter calls the allocator function pointer stored inside that state. A second use-after-free in is fixed in the same change: the logged module string was freed while the debugger log list still held a reference to it. ## Mitigation You can mitigate this issue by using Valkey ACLs to restrict the SCRIPT command, in particular , if your application doesn't intend to use the script debugger. ## Credits The defect was independently reported by Trung Nguyen (@everping) of CyStack, by Phuc Nguyen Dinh (pucagit) of CyStack, and Han Sang-Kyung (toky1219@gmail.com). The fix was authored by https://github.com/Baraa-Hasheesh.