Valkey 8.1.11 → 9.0.4
5 releases · 0 breaking changes · 9 security fixes · 1 advisory fixed
9security0breaking0deprecated1feature37fix
Vulnerabilities fixed by this upgrade
- 7.5 CVE-2026-27623 Pre-Authentication DOS from malformed RESP request
Breaking changes
None in the release notes.
Security changes
- security (CVE-2026-23479) Use-After-Free in unblock client flow in 9.0.4
- security (CVE-2026-25243) Invalid Memory Access in RESTORE command in 9.0.4
- security (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution in 9.0.4
- security (CVE-2025-67733) RESP Protocol Injection via Lua error_reply in 9.0.3
- security (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message in 9.0.3
- security (CVE-2026-27623) Reset request type after handling empty requests in 9.0.3
- security Fixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply in 9.0.2
- security Fixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply in 9.0.0
- security Fixes CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message in 9.0.0
Every release in between
security(CVE-2026-23479) Use-After-Free in unblock client flow
security(CVE-2026-25243) Invalid Memory Access in RESTORE command
security(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution
security(CVE-2025-67733) RESP Protocol Injection via Lua error_reply
security(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
security(CVE-2026-27623) Reset request type after handling empty requests
fixAvoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
fixFix server assert on ACL LOAD when current user loses permission to channels (#3182)
fixFix bug causing no response flush sometimes when IO threads are busy (#3205)
securityFixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply
fixAvoid memory leak of new argv when HEXPIRE commands target only non-exiting fields (#2973)
fixFix HINCRBY and HINCRBYFLOAT to update volatile key tracking (#2974)
fixAvoid empty hash object when HSETEX added no fields (#2998)
fixFix case-sensitive check for the FNX and FXX arguments in HSETEX (#3000)
fixPrevent assertion in active expiration job after a hash with volatile fields is overwritten (#3003, #3007)
fixFix HRANDFIELD to return null response when no field could be found (#3022)
fixFix HEXPIRE to not delete items when validation rules fail and expiration is in the past (#3023, #3048)
fixFix how hash is handling overriding of expired fields overwrite (#3060)
fixHSETEX - Always issue keyspace notifications after validation (#3001)
fixMake zero a valid TTL for hash fields during import mode and data loading (#3006)
fixTrigger prepareCommand on argc change in module command filters (#2945)
fixRestrict TTL from being negative and avoid crash in import-mode (#2944)
fixFix chained replica crash when doing dual channel replication (#2983)
fixSkip slot cache optimization for AOF client to prevent key duplication and data corruption (#3004)
fixFix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
fixAvoid duplicate calculations of network-bytes-out in slot stats with copy-avoidance (#3046)
fixFix XREAD returning error on empty stream with + ID (#2742)
featureTrack reply bytes in I/O threads if commandlog-reply-larger-than is -1 (#3086, #3126). This makes it possible to mitigate a performance regression in 9.0.1 caused by the bug fix #2652.
fixAuthenticate slot migration client on source node to internal user (#2785)
fixBug fix: reset io_last_written on c->buf resize to prevent stale pointers (#2786)
fixSentinel: fix regression requiring "+failover" ACL in failover path (#2780)
fixCluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#2817)
fixSend duplicate multi meet packet only for node which supports it in mixed clusters (#2840)
fixFix: LTRIM should not call signalModifiedKey when no elements are removed (#2787)
fixFix build on some 32-bit ARM by only using NEON on AArch64 (#2873)
fixFix deadlock in IO-thread shutdown during panic (#2898)
fixFix COMMANDLOG large-reply when using reply copy avoidance (#2652)
fixFix CLUSTER SLOTS crash when called from module timer callback (#2915)
securityFixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply
securityFixes CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message
fixHSETEX with FXX should not create an object if it does not exist (#2716)
fixFix crash when aborting a slot migration while child snapshot is active (#2721)
fixFix double MOVED reply on unblock at failover (#2734)
fixFix memory leak with CLIENT LIST/KILL duplicate filters (#2362)
fixFix incorrect accounting after completed atomic slot migration (#2749)
fixFix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD (#1826, #2750)
fixFix invalid memory address caused by hashtable shrinking during safe iteration (#2753)