tlsProcessPendingData iterates the pending_list while an authenticated client can trigger CLIENT KILL, leading to a use‑after‑free of the iterator’s cached node. The flaw can crash the server or, when TLS is enabled, allow an attacker to execute arbitrary code on the host. This is a classic use‑after‑free condition (CWE‑416) that compromises integrity and availability and may directly lead to code execution.

Valkey from the valkey‑io organization is affected. Versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 are vulnerable. The issue is fixed in the corresponding release branches mentioned above.

The vulnerability scores a CVSS of 7.5 indicating high severity. EPSS is not available and the issue is not yet listed in the CISA KEV catalog, but the nature of the flaw and the fact that it can be triggered remotely over TLS means that exploitation is plausible. An attacker with a TLS connection to the server and permission to send CLIENT KILL can exploit the use‑after‑free. The lack of an exploitation block in the CVE data suggests the exact payload is not yet publicly demonstrated, but the risk of remote code execution remains.