Is Valkey 8.0.1 affected?

CVSS 8.8

9 known vulnerabilities affect 8.0.1 (highest CVSS 8.8).

35 newer releases in its track, up to 9.1.3. What changed up to 9.1.3

Vulnerabilities affecting 8.0.1

8.8
GHSA-f4q9-j22m-xqq9 Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow
8.8
GHSA-fq2f-crmw-q97r Unauthenticated use-after-free of the Lua interpreter state in Valkey (script debugger command cache)
8.8
CVE-2026-63639 UAF in stream deserialization may lead to remote code execution
8.5
CVE-2025-67733 RESP Protocol Injection via Lua error_reply fixed in 8.0.7
7.5
GHSA-jcj7-v34w-v9vv Use-after-free in the RDMA pending-data handler when a client
7.5
CVE-2026-56684 UAF in Valkey with TLS may lead to remote code execution
7.5
CVE-2026-27623 Pre-Authentication DOS from malformed RESP request
7.5
CVE-2025-21605 DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client fixed in 8.0.3
6.5
CVE-2026-21863 Remote DoS with malformed Valkey Cluster bus message fixed in 8.0.7