Valkey 8.1.8 → 9.1.2

12 releases · 0 breaking changes · 22 security fixes · 5 advisories fixed

22security0breaking0deprecated3feature198fix

Is 8.1.8 affected?

Vulnerabilities fixed by this upgrade

8.8 GHSA-fq2f-crmw-q97r Unauthenticated use-after-free of the Lua interpreter state in Valkey (script debugger command cache)
7.5 GHSA-jcj7-v34w-v9vv Use-after-free in the RDMA pending-data handler when a client
8.8 CVE-2026-63639 UAF in stream deserialization may lead to remote code execution
7.5 CVE-2026-56684 UAF in Valkey with TLS may lead to remote code execution
7.5 CVE-2026-27623 Pre-Authentication DOS from malformed RESP request

Breaking changes

None in the release notes.

Security changes

security GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534) in 9.1.2
security GHSA-fq2f-crmw-q97r: Fix an unauthenticated use-after-free of the Lua interpreter state, caused by a process-global script debugger command table that cached a raw pointer to a freed interpreter and was never invalidated (#4574) in 9.1.2
security CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234) in 9.1.1
security CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073) in 9.1.1
security (CVE-2026-23479) Use-After-Free in unblock client flow in 9.1.0
security (CVE-2026-25243) Invalid Memory Access in RESTORE command in 9.1.0
security (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution in 9.1.0
security GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534) in 9.0.6
security CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234) in 9.0.5
security CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073) in 9.0.5
security (CVE-2026-23479) Use-After-Free in unblock client flow in 9.0.4
security (CVE-2026-25243) Invalid Memory Access in RESTORE command in 9.0.4
security (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution in 9.0.4
security (CVE-2025-67733) RESP Protocol Injection via Lua error_reply in 9.0.3
security (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message in 9.0.3
security (CVE-2026-27623) Reset request type after handling empty requests in 9.0.3
security Fixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply in 9.0.2
security Fixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply in 9.0.0
security Fixes CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message in 9.0.0
security GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534) in 8.1.10
security CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234) in 8.1.9
security CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073) in 8.1.9

Every release in between

9.1.2 Sep 1, 2026 Release notes ↗

securityGHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)

securityGHSA-fq2f-crmw-q97r: Fix an unauthenticated use-after-free of the Lua interpreter state, caused by a process-global script debugger command table that cached a raw pointer to a freed interpreter and was never invalidated (#4574)

fixFix a double-free crash when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)

fixFix torn RESP3 push frames when a client publishes to a channel it is also subscribed to, which could desync client libraries by @quanyeyang (#4253)

fixListpacks are now always validated on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload and its ACL flags become no-ops by @jjuleslasarte (#3721)

fixFix crashes, hangs, and CPU spinning when the RDMA transport is used together with I/O threads by @quanyeyang (#3611)

fixRESET now clears the CLIENT IMPORT-SOURCE flag, so reused pooled connections return to normal expiration semantics by @tjade273 (#3973)

fixTruncate a partially written MULTI block from the AOF on short read, preventing loss of newer writes after a later restart by @chzhoo (#4342)

fixFix an ACL bypass where duplicate STORE/STOREDIST options let GEORADIUS write or delete keys outside the user's permitted patterns by @tjade273 (#3971)

fixFix command log redaction leaking between commands in a MULTI transaction and missing for commands executed from scripts by @madolson (#4323)

fixFix a use-after-free crash when a module's cluster message type is received after the module is unloaded by @enjoy-binbin (#4360)

fixFix out-of-bounds access for cluster module message type 255, which is now a valid, dispatchable message type by @enjoy-binbin (#4410)

fixAOF loading no longer performs ACL checks on replayed commands, preventing silent data loss when the default user is disabled by @lukepalmer (#3984)

fixFix a client memory accounting leak on replicas that inflated the mem_clients_normal INFO field after primary disconnections by @enjoy-binbin (#4395)

fixFix a permanent client deadlock when a blocking command like BLPOP is followed by a partially delivered pipelined command by @foobar (#4531)

fixHGETEX now requires write permission on the key, closing an ACL gap that let read-only users change field TTLs or delete fields by @ranshid (#4576)

fixCompare the whole TLS certificate CN during authentication, so an embedded NUL can no longer impersonate another ACL user by @madolson (#4577)

fixFix atomic slot migration failures with I/O threads by not offloading the export job's writes while snapshotting by @satheeshaGowda (#4104)

fixReject invalid slot import ranges when loading an RDB, so corrupted files can no longer create bad migration jobs by @enjoy-binbin (#4229)

fixReject RDB slot import records with an invalid job name length, preventing an out-of-bounds read at startup by @quanyeyang (#4210)

fixMOVE and COPY now check ACL access to the current database, so users can no longer exfiltrate keys from an unauthorized DB by @cjx-zar (#4155)

fixFix a crash on COPY with a trailing DB option during slot migration, and block cross-DB COPY regardless of option order by @madolson (#4301)

fixFix a server panic when pipelined commands with invalid arity reach the key prefetcher with I/O threads enabled by @madolson (#4302)

fixHPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a syntax error when the FIELDS keyword is missing by @cjx-zar (#4300)

fixFix a race between TLS I/O-thread writes and reads that could leave slot migration export jobs stuck until timeout by @jjuleslasarte (#4320)

fixFix a signed overflow that let very large hash field expiration times (e.g. via HPEXPIREAT) crash the server by @ranshid (#4312)

fixFix a frozen monotonic clock on hosts with unsynchronized TSC that stopped background tasks and key expiration by @quanyeyang (#4346)

fixFix a stack overflow crash when retrying a failed TLS write with a large reply by @murphyjacob4 (#4307)

fixFix the --check-system clocksource check to skip hosts using a hardware clock and suggest only actually available clocksources by @quanyeyang (#4272)

fixFix an assertion failure with I/O threads when a blocked client's pending command was processed again before unblocking by @quanyeyang (#4376)

fixSentinel no longer loads the built-in Lua scripting engine, removing a spurious warning at startup by @enjoy-binbin (#4327)

fixValidate channel, message, and module payload lengths in cluster bus packets, preventing forged packets from crashing nodes by @tjade273 (#3972)

fixHarden stream validation on RDB load and RESTORE so crafted payloads can no longer crash the server on later commands by @madolson (#3922)

fixReject stream payloads with mismatched live/deleted record counts, preventing XDEL from destroying unaccounted entries by @roshkhatri (#4381)

fixSkip unnecessary post-read processing with I/O threads on socket and TLS connections, restoring small-payload throughput by @quanyeyang (#4401)

fixFix a use-after-free crash when serving clients blocked on the same key if one client is freed during processing by @quanyeyang (#4212)

fixAvoid an unneeded client lookup per write completion with I/O threads on socket and TLS connections, improving pipelined throughput by @dgershko (#4440)

fixFix CLUSTER SLOT-STATS ORDERBY returning wrong ordering when slot counters differ by more than 2^31 by @jzy1688 (#4459)

fixFix slot migration failures with I/O threads and TLS by keeping the export job's ACK reads on the main thread while snapshotting by @satheeshaGowda (#4559)

9.1.1 Jul 21, 2026 Release notes ↗

securityCVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)

securityCVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

fixOmit the implicit alldbs ACL rule from ACL LIST, ACL SAVE and CONFIG REWRITE so older versions can parse the output by @dvkashapov (#3964)

fixImprove throughput when IO threads are enabled by offloading object deallocation from the main thread by @roshkhatri (#3938)

fixFix use-after-free crash when ACL LOAD removes a user whose authenticated client has its close deferred by @ranshid (#3800)

fixEnforce db= ACL permissions on every DB clause of COPY, closing a bypass with REPLACE or repeated DB tokens by @enjoy-binbin (#3801)

fixEnforce database-level ACLs for CLUSTER FLUSHSLOT, which removes keys from all databases by @enjoy-binbin (#3806)

fixFix use-after-free in the module API when unregistering the first registered cluster message receiver by @eifrah-aws (#3846)

fixFix HRANDFIELD with a positive count looping forever when non-expired fields are fewer than the requested count by @cjx-zar (#4047)

fixFix clients left on the wrong database after module keyspace notifications for MOVE and COPY by @enjoy-binbin (#4024)

fixFix Sentinel crash during coordinated failover when the command link to the old primary disconnects by @lukepalmer (#4068)

fixFix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed by @ranshid (#3950)

fixFix assertion in HEXPIRE, HGETDEL and HPERSIST when a module blocks the client in a keyspace notification callback by @enjoy-binbin (#3743)

fixFix undefined behavior in the failover delay calculation when cluster-node-timeout is below 30 milliseconds by @enjoy-binbin (#3941)

fixReject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)

fixReject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion by @madolson (#3921)

fixFix corrupted replies (dropped leading bytes) caused by a reply buffer race when IO threads are enabled by @nanyan0312 (#4060)

fixFix startup crash on 32-bit systems where time_t is 64-bit (such as Alpine 3.23) when generating INFO output by @chenshi5012 (#3787)

fixHGETDEL now returns a syntax error when the FIELDS keyword is missing or misplaced by @lcxn123 (#4049)

fixCOMMAND INFO in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands by @rickrams (#3939)

fixSend the replica version on the dual-channel RDB connection so full syncs with newer encodings like hash field TTLs succeed by @hpatro (#4105)

fixFix duplicate failure handling and an invalid reply sequence in cluster slot migration by @chx9 (#3723)

fixReject control characters in SENTINEL SET values to prevent config-file injection via Sentinel config rewrite by @eifrah-aws (#3847)

fixReject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to prevent nodes.conf injection by @eifrah-aws (#3848)

fixRedact key names and user data from more server log messages when hide-user-data-from-log is enabled by @zackcam (#3872)

fixACL LOG now reports the denied database ID for COPY instead of the command name when db= access is denied by @enjoy-binbin (#3888)

fixFix garbled shard IDs in the cluster UPDATE message log line by @enjoy-binbin (#3942)

fixFix negative master_sync_total_bytes in INFO replication during disk-based sync when the RDB exceeds 2GB by @chx9 (#3811)

fixIncrease the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @pkhartsk (#3843)

9.1.0 May 19, 2026 Release notes ↗

security(CVE-2026-23479) Use-After-Free in unblock client flow

security(CVE-2026-25243) Invalid Memory Access in RESTORE command

security(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

featureAdd cluster bus network traffic usage metric in bytes by @hpatro (#3396)

featureReduce latency spikes during rehashing via incremental page release by @chzhoo (#3481)

fixFix(syncio): Set errno on EOF in syncRead and propagate to conn->last by @abmathur-ie (#3580)

fixFix GEOSEARCH BYPOLYGON leak on invalid COUNT by @bandalgomsu (#3568)

fixHandle NULL pointer in streamTrim listpack delta calculation by @smkher (#3591)

fixFixes server crash when RDMA benchmark clients disconnect by @quanyeyang (#3448)

fixFix the memory leak in valkey-benchmark by @nmvk (#3643)

9.0.6 Sep 1, 2026 Release notes ↗

fixFix crashes, assertion failures, and hangs when using RDMA together with IO threads by @quanyeyang (#3335)

fixFix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)

fixFix torn RESP3 push frames when a client publishes a large message to a channel it is also subscribed to by @quanyeyang (#4253)

fixRESET now clears CLIENT IMPORT-SOURCE state so reused pooled connections regain normal key expiration semantics by @tjade273 (#3973)

fixTruncated AOF files now discard an incomplete MULTI block entirely, preventing loss of later writes after another restart by @chzhoo (#4342)

fixFix an ACL bypass in GEORADIUS and GEORADIUSBYMEMBER where duplicate STORE options checked only the first destination key by @tjade273 (#3971)

fixFix a use-after-free crash when a cluster message arrives for a message type registered by an unloaded module by @enjoy-binbin (#4360)

fixAlways deep-validate payloads on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload is now a deprecated no-op by @jjuleslasarte (#3721)

fixFix out-of-bounds memory access when registering or receiving cluster module messages of type 255, which is now a valid type by @enjoy-binbin (#4410)

fixAOF loading no longer applies ACL checks, preventing silent data loss when replaying commands with a disabled default user by @lukepalmer (#3984)

fixFix a client memory accounting leak that inflated the mem_clients_normal INFO field on replicas after primary disconnects by @enjoy-binbin (#4395)

fixFix a permanent client hang when a blocking command such as BLPOP is pipelined with a partially received next command by @foobar (#4531)

fixHGETEX now requires write permission on the key, so read-only ACL users can no longer change field TTLs or delete fields by @ranshid (#4576)

fixCompare the full TLS certificate CN when authenticating, so an embedded NUL cannot impersonate a truncated ACL username by @madolson (#4577)

fixRestore read performance with IO threads on TCP/TLS by applying extra read-completion handling only to RDMA connections by @quanyeyang (#4414)

fixRestore write performance with IO threads on TCP/TLS by limiting post-write safety checks to RDMA connections by @quanyeyang (#4452)

fixFix atomic slot migration protocol errors with IO threads by not offloading export connection writes while snapshotting by @satheeshaGowda (#4104)

fixReject invalid slot import ranges when loading an RDB, preventing corrupted files from creating bad migration state by @enjoy-binbin (#4229)

fixReject RDB slot-import records with an invalid job name length, fixing an out-of-bounds read during startup by @quanyeyang (#4210)

fixFix a crash when COPY ends with a bare DB token during slot migration, and block cross-DB COPY regardless of option order by @madolson (#4301)

fixHPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a syntax error when the FIELDS keyword is missing by @cjx-zar (#4300)

fixFix a TLS and IO threads race that could leave slot migration export jobs stuck until timeout by @jjuleslasarte (#4320)

fixFix a server crash when hash field expirations are set near the maximum timestamp, for example via HPEXPIREAT by @ranshid (#4312)

fixFix a stack overflow crash on TLS connections when retrying a failed write of large replies by @murphyjacob4 (#4307)

fixValidate cluster bus PUBLISH and MODULE packet payload lengths, preventing a remote crash from forged length fields by @tjade273 (#3972)

fixFix a use-after-free crash when serving blocked clients if handling one client frees another blocked on the same key by @quanyeyang (#4212)

fixFix a server panic with IO threads when pipelined commands with a wrong number of arguments reached the key prefetcher by @madolson (#4302)

fixReject crafted stream RESTORE and RDB payloads with inconsistent lengths or negative field counts that could crash the server by @madolson (#3922)

fixReject stream payloads with mismatched live and deleted entry counts that could make XDEL destroy live entries by @roshkhatri (#4381)

fixFix CLUSTER SLOT-STATS ORDERBY returning wrong ordering once cumulative slot counters differ by more than 2^31 by @jzy1688 (#4459)

fixFix atomic slot migration failures with TLS and IO threads by not offloading export connection reads while snapshotting by @satheeshaGowda (#4559)

9.0.5 Jul 21, 2026 Release notes ↗

securityCVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)

securityCVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

fixStrictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed by @enjoy-binbin (#2872)

fixFix a use-after-free crash when creating slot import jobs during manual slot migrations by @twooster (#3283)

fixFix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed by @sarthakaggarwal97 (#3342)

fixFix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type by @madolson (#3516)

fixFix a crash from a race between IO threads and asynchronous client freeing by @deepakrn (#3458)

fixFix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE by @enjoy-binbin (#3498)

fixFix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted by @smkher (#3591)

fixFix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active by @eifrah-aws (#3578)

fixFix a NULL pointer crash in TLS pending-data handling by @zuiderkwast (#3641)

fixFix a server crash when multiple RDMA clients disconnect at the same time by @quanyeyang (#3448)

fixFix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately by @ranshid (#3800)

fixFix a use-after-free when a module unregisters the first registered cluster message receiver for a message type by @eifrah-aws (#3846)

fixFix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count by @cjx-zar (#4047)

fixFix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY by @enjoy-binbin (#4024)

fixFix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected by @lukepalmer (#4068)

fixFix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly by @dvkashapov (#3306)

fixFix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue by @jjuleslasarte (#3878)

fixFix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket by @ranshid (#3950)

fixFix a file descriptor leak when a blocking connection attempt, such as MIGRATE to an unreachable host, times out by @madolson (#3541)

fixFix a potential crash from a dangling slot migration job reference when the migration client is reset by @murphyjacob4 (#3554)

fixRemove cached EVAL scripts when their scripting engine is unregistered, preventing dangling engine references by @eifrah-aws (#3503)

fixFix a memory leak in GEOSEARCH BYPOLYGON when argument parsing fails, such as on an invalid COUNT by @bandalgomsu (#3568)

fixFix a crash when a slot migration target node is removed from the cluster before the migration connects by @chenshi5012 (#3596)

fixFix a crash when the module GetLRU/SetLRU/GetLFU/SetLFU APIs are called with a NULL key by @yaronsananes (#3610)

fixFix an assertion failure in hash field expiration commands when a module blocks the client in a keyspace notification by @enjoy-binbin (#3743)

fixFix a cluster UPDATE log message reading shard IDs past their fixed-length buffer by @enjoy-binbin (#3942)

fixFix undefined behavior in the failover delay calculation when cluster-node-timeout is set below 30 milliseconds by @enjoy-binbin (#3941)

fixReject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)

fixReject NAN scores in listpack- and ziplist-encoded sorted sets on RDB/RESTORE load, preventing a later crash on skiplist conversion by @madolson (#3921)

fixFix a startup crash on 32-bit systems with 64-bit time_t, such as Alpine 3.23, caused by time value formatting mismatches by @chenshi5012 (#3787)

fixFix corrupted client replies when IO threads are enabled, caused by a race between in-flight writes and reply buffer reuse by @nanyan0312 (#4060)

fixCOMMAND INFO in RESP3 now returns the subcommands field as an Array instead of a Set for commands without subcommands by @rickrams (#3939)

fixThe dual-channel replication RDB connection now announces the configured replica-announce-ip, avoiding stale replica entries behind NAT by @jdheyburn (#2846)

fixPrevent replicas from processing stale cluster packets and incorrectly promoting themselves to an empty primary within a shard by @zhijun42 (#2811)

fixSend the replica version on the dual-channel RDB connection so full syncs of data like hash field TTLs no longer fail by @hpatro (#4105)

fixFix slot migration failure handling running twice on ownership changes and an out-of-order error reply in the internal SYNCSLOTS FINISH command by @chx9 (#3723)

fixAllow slot-migration-max-failover-repl-bytes to be set to -1 to disable the limit, as documented by @enjoy-binbin (#3443)

fixFix CONFIG REWRITE producing negative values for memory configs such as maxmemory when set to very large values by @enjoy-binbin (#3440)

+11 more items in the release notes

9.0.4 May 6, 2026 Release notes ↗

security(CVE-2026-23479) Use-After-Free in unblock client flow

security(CVE-2026-25243) Invalid Memory Access in RESTORE command

security(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

9.0.3 Feb 24, 2026 Release notes ↗

security(CVE-2025-67733) RESP Protocol Injection via Lua error_reply

security(CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message

security(CVE-2026-27623) Reset request type after handling empty requests

fixAvoids crash during MODULE UNLOAD when ACL rules reference a module command and subcommand (#3160)

fixFix server assert on ACL LOAD when current user loses permission to channels (#3182)

fixFix bug causing no response flush sometimes when IO threads are busy (#3205)

9.0.2 Feb 3, 2026 Release notes ↗

securityFixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply

fixAvoid memory leak of new argv when HEXPIRE commands target only non-exiting fields (#2973)

fixFix HINCRBY and HINCRBYFLOAT to update volatile key tracking (#2974)

fixAvoid empty hash object when HSETEX added no fields (#2998)

fixFix case-sensitive check for the FNX and FXX arguments in HSETEX (#3000)

fixPrevent assertion in active expiration job after a hash with volatile fields is overwritten (#3003, #3007)

fixFix HRANDFIELD to return null response when no field could be found (#3022)

fixFix HEXPIRE to not delete items when validation rules fail and expiration is in the past (#3023, #3048)

fixFix how hash is handling overriding of expired fields overwrite (#3060)

fixHSETEX - Always issue keyspace notifications after validation (#3001)

fixMake zero a valid TTL for hash fields during import mode and data loading (#3006)

fixTrigger prepareCommand on argc change in module command filters (#2945)

fixRestrict TTL from being negative and avoid crash in import-mode (#2944)

fixFix chained replica crash when doing dual channel replication (#2983)

fixSkip slot cache optimization for AOF client to prevent key duplication and data corruption (#3004)

fixFix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)

fixAvoid duplicate calculations of network-bytes-out in slot stats with copy-avoidance (#3046)

fixFix XREAD returning error on empty stream with + ID (#2742)

featureTrack reply bytes in I/O threads if commandlog-reply-larger-than is -1 (#3086, #3126). This makes it possible to mitigate a performance regression in 9.0.1 caused by the bug fix #2652.

9.0.1 Dec 9, 2025 Release notes ↗

fixAuthenticate slot migration client on source node to internal user (#2785)

fixBug fix: reset io_last_written on c->buf resize to prevent stale pointers (#2786)

fixSentinel: fix regression requiring "+failover" ACL in failover path (#2780)

fixCluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#2817)

fixSend duplicate multi meet packet only for node which supports it in mixed clusters (#2840)

fixFix: LTRIM should not call signalModifiedKey when no elements are removed (#2787)

fixFix build on some 32-bit ARM by only using NEON on AArch64 (#2873)

fixFix deadlock in IO-thread shutdown during panic (#2898)

fixFix COMMANDLOG large-reply when using reply copy avoidance (#2652)

fixFix CLUSTER SLOTS crash when called from module timer callback (#2915)

9.0.0 Oct 21, 2025 Release notes ↗

securityFixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply

securityFixes CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message

fixHSETEX with FXX should not create an object if it does not exist (#2716)

fixFix crash when aborting a slot migration while child snapshot is active (#2721)

fixFix double MOVED reply on unblock at failover (#2734)

fixFix memory leak with CLIENT LIST/KILL duplicate filters (#2362)

fixFix incorrect accounting after completed atomic slot migration (#2749)

fixFix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD (#1826, #2750)

fixFix invalid memory address caused by hashtable shrinking during safe iteration (#2753)

8.1.10 Aug 31, 2026 Release notes ↗

fixFix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)

fixRESET now clears the CLIENT IMPORT-SOURCE flag so reused pooled connections stop reading logically expired keys by @tjade273 (#3973)

fixFix AOF recovery of a truncated MULTI/EXEC block that could cause new writes to be lost after a subsequent restart by @chzhoo (#4342)

fixFix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands escaped key write permission checks by @tjade273 (#3971)

fixFix a use-after-free crash when a cluster message of a module-registered type arrives after the module is unloaded by @enjoy-binbin (#4360)

fixFix out-of-bounds access when registering or receiving cluster module messages of type 255, which is now fully supported by @enjoy-binbin (#4410)

fixSkip ACL permission checks when replaying the AOF, preventing silent data loss when users are restricted or disabled by @lukepalmer (#3984)

fixFix a client memory accounting leak that inflated mem_clients_normal on replicas after disconnecting from the primary by @enjoy-binbin (#4395)

fixAlways validate listpacks on RDB load and RESTORE to prevent deferred crashes; sanitize-dump-payload and the related ACL flags are now deprecated no-ops by @jjuleslasarte (#3721)

fixFix a stack overflow crash when retrying large TLS writes after an OpenSSL write error by @murphyjacob4 (#4307)

fixValidate PUBLISH and MODULE cluster bus packet lengths, preventing a crash from forged packets with oversized payload lengths by @tjade273 (#3972)

fixReject crafted stream RESTORE/RDB payloads with inconsistent lengths or negative field counts that could crash the server by @madolson (#3922)

fixFix a use-after-free crash when serving multiple clients blocked on the same key if one is freed during processing by @quanyeyang (#4212)

fixFix CLUSTER SLOT-STATS ORDERBY sorting when slot statistics differ by more than 2^31 by @jzy1688 (#4459)

8.1.9 Jul 21, 2026 Release notes ↗

securityCVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)

securityCVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

fixFix clients being left on the wrong database after module keyspace notifications from commands like MOVE and COPY by @enjoy-binbin (#4024)

fixFix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64 by @jjuleslasarte (#3878)

fixReject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)

fixReject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted RESTORE payloads by @madolson (#3921)

fixFix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit (e.g. Alpine time64) by @chenshi5012 (#3787)

fixFix COMMAND INFO in RESP3 to reply with an empty Array instead of a Set for commands without subcommands by @rickrams (#3939)

fixReject invalid characters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf corruption and injection by @eifrah-aws (#3848)

fixFix lua-enable-insecure-api having no effect when enabled at startup via config file or command line by @enjoy-binbin (#3548)

fixIncrease the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)