Valkey
Databases · products/valkey.yaml · RSS
Latest 9.1.2 Sep 1, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 9.1 | 9.1.2 | May 19, 2026 | May 19, 2031 · maintained |
| 9.0 | 9.0.6 | Oct 21, 2025 | Oct 21, 2028 · maintained |
| 8.1 | 8.1.10 | Mar 31, 2025 | Mar 31, 2030 · maintained |
| 8.0 | 8.0.11 | Sep 15, 2024 | Sep 15, 2027 · maintained |
| 7.2 | 7.2.14 | Apr 16, 2024 | Apr 16, 2029 · maintained |
Recent releases
securityGHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
securityGHSA-fq2f-crmw-q97r: Fix an unauthenticated use-after-free of the Lua interpreter state, caused by a process-global script debugger command table that cached a raw pointer to a freed interpreter and was never invalidated (#4574)
securityCVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
securityCVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)
security(CVE-2026-23479) Use-After-Free in unblock client flow
security(CVE-2026-25243) Invalid Memory Access in RESTORE command
security(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution
securityGHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
securityCVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
securityCVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)
security(CVE-2026-23479) Use-After-Free in unblock client flow
security(CVE-2026-25243) Invalid Memory Access in RESTORE command
security(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution
security(CVE-2025-67733) RESP Protocol Injection via Lua error_reply
security(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
security(CVE-2026-27623) Reset request type after handling empty requests
securityFixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply
securityFixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply
securityFixes CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message
securityGHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
securityCVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
securityCVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)
security(CVE-2026-23479) Use-After-Free in unblock client flow
security(CVE-2026-25243) Invalid Memory Access in RESTORE command
security(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution
security(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
security(CVE-2025-67733) RESP Protocol Injection via Lua error_reply
Security advisories
8.8 GHSA-fq2f-crmw-q97r Unauthenticated use-after-free of the Lua interpreter state in Valkey (script debugger command cache)
7.5 CVE-2025-21605 DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client