Valkey 8.1.2 → 9.0.4
13 releases · 0 breaking changes · 23 security fixes · 3 advisories fixed
23security0breaking0deprecated1feature100fix
Vulnerabilities fixed by this upgrade
- 7.5 CVE-2026-27623 Pre-Authentication DOS from malformed RESP request
- 6.5 CVE-2026-21863 Remote DoS with malformed Valkey Cluster bus message
- 8.5 CVE-2025-67733 RESP Protocol Injection via Lua error_reply
Breaking changes
None in the release notes.
Security changes
- security (CVE-2026-23479) Use-After-Free in unblock client flow in 9.0.4
- security (CVE-2026-25243) Invalid Memory Access in RESTORE command in 9.0.4
- security (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution in 9.0.4
- security (CVE-2025-67733) RESP Protocol Injection via Lua error_reply in 9.0.3
- security (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message in 9.0.3
- security (CVE-2026-27623) Reset request type after handling empty requests in 9.0.3
- security Fixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply in 9.0.2
- security Fixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply in 9.0.0
- security Fixes CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message in 9.0.0
- security GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534) in 8.1.10
- security CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234) in 8.1.9
- security CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073) in 8.1.9
- security (CVE-2026-23479) Use-After-Free in unblock client flow in 8.1.7
- security (CVE-2026-25243) Invalid Memory Access in RESTORE command in 8.1.7
- security (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution in 8.1.7
- security (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message in 8.1.6
- security (CVE-2025-67733) RESP Protocol Injection via Lua error_reply in 8.1.6
- security (CVE-2025-49844) A Lua script may lead to remote code execution in 8.1.4
- security (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE in 8.1.4
- security (CVE-2025-46818) A Lua script can be executed in the context of another user in 8.1.4
- security (CVE-2025-46819) LUA out-of-bound read in 8.1.4
- security CVE-2025-32023 prevent out-of-bounds write during hyperloglog operations (#2146) in 8.1.3
- security CVE-2025-48367 retry accept on transient errors (#2315) in 8.1.3
Every release in between
security(CVE-2026-23479) Use-After-Free in unblock client flow
security(CVE-2026-25243) Invalid Memory Access in RESTORE command
security(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution
security(CVE-2025-67733) RESP Protocol Injection via Lua error_reply
security(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
security(CVE-2026-27623) Reset request type after handling empty requests
fixAvoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)
fixFix server assert on ACL LOAD when current user loses permission to channels (#3182)
fixFix bug causing no response flush sometimes when IO threads are busy (#3205)
securityFixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply
fixAvoid memory leak of new argv when HEXPIRE commands target only non-exiting fields (#2973)
fixFix HINCRBY and HINCRBYFLOAT to update volatile key tracking (#2974)
fixAvoid empty hash object when HSETEX added no fields (#2998)
fixFix case-sensitive check for the FNX and FXX arguments in HSETEX (#3000)
fixPrevent assertion in active expiration job after a hash with volatile fields is overwritten (#3003, #3007)
fixFix HRANDFIELD to return null response when no field could be found (#3022)
fixFix HEXPIRE to not delete items when validation rules fail and expiration is in the past (#3023, #3048)
fixFix how hash is handling overriding of expired fields overwrite (#3060)
fixHSETEX - Always issue keyspace notifications after validation (#3001)
fixMake zero a valid TTL for hash fields during import mode and data loading (#3006)
fixTrigger prepareCommand on argc change in module command filters (#2945)
fixRestrict TTL from being negative and avoid crash in import-mode (#2944)
fixFix chained replica crash when doing dual channel replication (#2983)
fixSkip slot cache optimization for AOF client to prevent key duplication and data corruption (#3004)
fixFix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
fixAvoid duplicate calculations of network-bytes-out in slot stats with copy-avoidance (#3046)
fixFix XREAD returning error on empty stream with + ID (#2742)
featureTrack reply bytes in I/O threads if commandlog-reply-larger-than is -1 (#3086, #3126). This makes it possible to mitigate a performance regression in 9.0.1 caused by the bug fix #2652.
fixAuthenticate slot migration client on source node to internal user (#2785)
fixBug fix: reset io_last_written on c->buf resize to prevent stale pointers (#2786)
fixSentinel: fix regression requiring "+failover" ACL in failover path (#2780)
fixCluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#2817)
fixSend duplicate multi meet packet only for node which supports it in mixed clusters (#2840)
fixFix: LTRIM should not call signalModifiedKey when no elements are removed (#2787)
fixFix build on some 32-bit ARM by only using NEON on AArch64 (#2873)
fixFix deadlock in IO-thread shutdown during panic (#2898)
fixFix COMMANDLOG large-reply when using reply copy avoidance (#2652)
fixFix CLUSTER SLOTS crash when called from module timer callback (#2915)
securityFixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply
securityFixes CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message
fixHSETEX with FXX should not create an object if it does not exist (#2716)
fixFix crash when aborting a slot migration while child snapshot is active (#2721)
fixFix double MOVED reply on unblock at failover (#2734)
fixFix memory leak with CLIENT LIST/KILL duplicate filters (#2362)
fixFix incorrect accounting after completed atomic slot migration (#2749)
fixFix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD (#1826, #2750)
fixFix invalid memory address caused by hashtable shrinking during safe iteration (#2753)
securityGHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
fixFix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
fixRESET now clears the CLIENT IMPORT-SOURCE flag so reused pooled connections stop reading logically expired keys by @tjade273 (#3973)
fixFix AOF recovery of a truncated MULTI/EXEC block that could cause new writes to be lost after a subsequent restart by @chzhoo (#4342)
fixFix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands escaped key write permission checks by @tjade273 (#3971)
fixFix a use-after-free crash when a cluster message of a module-registered type arrives after the module is unloaded by @enjoy-binbin (#4360)
fixFix out-of-bounds access when registering or receiving cluster module messages of type 255, which is now fully supported by @enjoy-binbin (#4410)
fixSkip ACL permission checks when replaying the AOF, preventing silent data loss when users are restricted or disabled by @lukepalmer (#3984)
fixFix a client memory accounting leak that inflated mem_clients_normal on replicas after disconnecting from the primary by @enjoy-binbin (#4395)
fixAlways validate listpacks on RDB load and RESTORE to prevent deferred crashes; sanitize-dump-payload and the related ACL flags are now deprecated no-ops by @jjuleslasarte (#3721)
fixFix a stack overflow crash when retrying large TLS writes after an OpenSSL write error by @murphyjacob4 (#4307)
fixValidate PUBLISH and MODULE cluster bus packet lengths, preventing a crash from forged packets with oversized payload lengths by @tjade273 (#3972)
fixReject crafted stream RESTORE/RDB payloads with inconsistent lengths or negative field counts that could crash the server by @madolson (#3922)
fixFix a use-after-free crash when serving multiple clients blocked on the same key if one is freed during processing by @quanyeyang (#4212)
fixFix CLUSTER SLOT-STATS ORDERBY sorting when slot statistics differ by more than 2^31 by @jzy1688 (#4459)
securityCVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
securityCVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)
fixFix clients being left on the wrong database after module keyspace notifications from commands like MOVE and COPY by @enjoy-binbin (#4024)
fixFix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64 by @jjuleslasarte (#3878)
fixReject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
fixReject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted RESTORE payloads by @madolson (#3921)
fixFix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit (e.g. Alpine time64) by @chenshi5012 (#3787)
fixFix COMMAND INFO in RESP3 to reply with an empty Array instead of a Set for commands without subcommands by @rickrams (#3939)
fixReject invalid characters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf corruption and injection by @eifrah-aws (#3848)
fixFix lua-enable-insecure-api having no effect when enabled at startup via config file or command line by @enjoy-binbin (#3548)
fixIncrease the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)
fixFix ZDIFF algorithm 2 memory leak on early exit (#3342)
fixStrictly check CRLF when parsing querybuf (#2872)
fixFix incorrect memory overhead calculation for watched keys (#3359)
fixFix valkey-cli --cluster del-node for unreachable nodes (#3209)
fixFix race condition during async client freeing with IO threading enabled (#3458)
fixFix double free in stream consumer PEL loading with corrupt RDB data (#3498)
fixFixes server crash when RDMA benchmark clients disconnect (#3448)
fixFix misleading log "I/O error reading bulk count from PRIMARY: Success" (#3580)
fixHandle NULL pointer in streamTrim listpack delta calculation (#3591)
fixFix Deferred Reply Placeholders in Active Deferred Buffers (#3578)
fixAdd NULL check in updateSSLPendingFlag (#3641)
fixFix heap-use-after-free in ACL LOAD when client free is deferred (#3800)
fixRedacting customer information when hide_user_data_from_log is true in rdb.c, networking.c, debug.c and t_hash (#3872)
fixFix use-after-free in VM_RegisterClusterMessageReceiver (#3846)
fixHarden SENTINEL commands and config rewrite against control-character injection (#3847)
fixFix CLUSTER SLOTS crash when called from module timer callback (#2915)
security(CVE-2026-23479) Use-After-Free in unblock client flow
security(CVE-2026-25243) Invalid Memory Access in RESTORE command
security(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution
security(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
security(CVE-2025-67733) RESP Protocol Injection via Lua error_reply
fixRestrict ttl from being negative and avoid crash in import-mode (#2944)
fixFix chained replica crash when doing dual channel replication (#2983)
fixFix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
fixFix crashing while MODULE UNLOAD when ACL rules reference a module command or subcommand (#3160)
fixFix server assert on ACL LOAD and resetchannels (#3182)
fixFix bug causing no response flush sometimes when IO threads are busy (#3205)
fixFix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD (#1826)
fixFix invalid memory address caused by hashtable shrinking during safe iteration (#2753)
fixCluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#2817)
fixSend duplicate multi meet packet only for node which supports it (#2840)
fixFix loading AOF files from future Valkey versions (#2899)
security(CVE-2025-49844) A Lua script may lead to remote code execution
security(CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
security(CVE-2025-46818) A Lua script can be executed in the context of another user
security(CVE-2025-46819) LUA out-of-bound read
fixFix accounting for dual channel RDB bytes in replication stats (#2614)
fixFix EVAL to report unknown error when empty error table is provided (#2229)
fixFix use-after-free when active expiration triggers hashtable to shrink (#2257)
fixFix MEMORY USAGE to account for embedded keys (#2290)
fixFix memory leak when shrinking a hashtable without entries (#2288)
fixPrevent potential assertion in active defrag handling large allocations (#2353)
fixPrevent bad memory access when NOTOUCH client gets unblocked (#2347)
fixConverge divergent shard-id persisted in nodes.conf to primary's shard id (#2174)
fixFix client tracking memory overhead calculation (#2360)
fixFix RDB load per slot memory pre-allocation when loading from RDB snapshot (#2466)
fixDon't use AVX2 instructions if the CPU doesn't support it (#2571)
fixFix bug where active defrag may be unable to defrag sparsely filled pages (#2656)
fixFix missing response when AUTH is errored inside a transaction (#2287)
securityCVE-2025-32023 prevent out-of-bounds write during hyperloglog operations (#2146)
securityCVE-2025-48367 retry accept on transient errors (#2315)