Valkey 9.0.7 → 9.1.1
2 releases · 0 breaking changes · 5 security fixes · 2 advisories fixed
5security0breaking0deprecated2feature32fix
Vulnerabilities fixed by this upgrade
- 8.8 CVE-2026-63639 UAF in stream deserialization may lead to remote code execution
- 7.5 CVE-2026-56684 UAF in Valkey with TLS may lead to remote code execution
Breaking changes
None in the release notes.
Security changes
- security CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234) in 9.1.1
- security CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073) in 9.1.1
- security (CVE-2026-23479) Use-After-Free in unblock client flow in 9.1.0
- security (CVE-2026-25243) Invalid Memory Access in RESTORE command in 9.1.0
- security (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution in 9.1.0
Every release in between
securityCVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
securityCVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)
fixOmit the implicit alldbs ACL rule from ACL LIST, ACL SAVE and CONFIG REWRITE so older versions can parse the output by @dvkashapov (#3964)
fixImprove throughput when IO threads are enabled by offloading object deallocation from the main thread by @roshkhatri (#3938)
fixFix use-after-free crash when ACL LOAD removes a user whose authenticated client has its close deferred by @ranshid (#3800)
fixEnforce db= ACL permissions on every DB clause of COPY, closing a bypass with REPLACE or repeated DB tokens by @enjoy-binbin (#3801)
fixEnforce database-level ACLs for CLUSTER FLUSHSLOT, which removes keys from all databases by @enjoy-binbin (#3806)
fixFix use-after-free in the module API when unregistering the first registered cluster message receiver by @eifrah-aws (#3846)
fixFix HRANDFIELD with a positive count looping forever when non-expired fields are fewer than the requested count by @cjx-zar (#4047)
fixFix clients left on the wrong database after module keyspace notifications for MOVE and COPY by @enjoy-binbin (#4024)
fixFix Sentinel crash during coordinated failover when the command link to the old primary disconnects by @lukepalmer (#4068)
fixFix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed by @ranshid (#3950)
fixFix assertion in HEXPIRE, HGETDEL and HPERSIST when a module blocks the client in a keyspace notification callback by @enjoy-binbin (#3743)
fixFix undefined behavior in the failover delay calculation when cluster-node-timeout is below 30 milliseconds by @enjoy-binbin (#3941)
fixReject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
fixReject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion by @madolson (#3921)
fixFix corrupted replies (dropped leading bytes) caused by a reply buffer race when IO threads are enabled by @nanyan0312 (#4060)
fixFix startup crash on 32-bit systems where time_t is 64-bit (such as Alpine 3.23) when generating INFO output by @chenshi5012 (#3787)
fixHGETDEL now returns a syntax error when the FIELDS keyword is missing or misplaced by @lcxn123 (#4049)
fixCOMMAND INFO in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands by @rickrams (#3939)
fixSend the replica version on the dual-channel RDB connection so full syncs with newer encodings like hash field TTLs succeed by @hpatro (#4105)
fixFix duplicate failure handling and an invalid reply sequence in cluster slot migration by @chx9 (#3723)
fixReject control characters in SENTINEL SET values to prevent config-file injection via Sentinel config rewrite by @eifrah-aws (#3847)
fixReject control characters and delimiters in cluster AUX fields and validate cluster-announce-ip to prevent nodes.conf injection by @eifrah-aws (#3848)
fixRedact key names and user data from more server log messages when hide-user-data-from-log is enabled by @zackcam (#3872)
fixACL LOG now reports the denied database ID for COPY instead of the command name when db= access is denied by @enjoy-binbin (#3888)
fixFix garbled shard IDs in the cluster UPDATE message log line by @enjoy-binbin (#3942)
fixFix negative master_sync_total_bytes in INFO replication during disk-based sync when the RDB exceeds 2GB by @chx9 (#3811)
fixIncrease the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @pkhartsk (#3843)
security(CVE-2026-23479) Use-After-Free in unblock client flow
security(CVE-2026-25243) Invalid Memory Access in RESTORE command
security(CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution
featureAdd cluster bus network traffic usage metric in bytes by @hpatro (#3396)
featureReduce latency spikes during rehashing via incremental page release by @chzhoo (#3481)
fixFix(syncio): Set errno on EOF in syncRead and propagate to conn->last by @abmathur-ie (#3580)
fixFix GEOSEARCH BYPOLYGON leak on invalid COUNT by @bandalgomsu (#3568)
fixHandle NULL pointer in streamTrim listpack delta calculation by @smkher (#3591)
fixFixes server crash when RDMA benchmark clients disconnect by @quanyeyang (#3448)
fixFix the memory leak in valkey-benchmark by @nmvk (#3643)