Is Valkey 9.1.0 affected?

CVSS 8.8

4 known vulnerabilities affect 9.1.0 (highest CVSS 8.8).

2 newer releases in its track, up to 9.1.2. What changed up to 9.1.2

Vulnerabilities affecting 9.1.0

8.8
GHSA-fq2f-crmw-q97r Unauthenticated use-after-free of the Lua interpreter state in Valkey (script debugger command cache)
8.8
CVE-2026-63639 UAF in stream deserialization may lead to remote code execution
7.5
GHSA-jcj7-v34w-v9vv Use-after-free in the RDMA pending-data handler when a client
7.5
CVE-2026-56684 UAF in Valkey with TLS may lead to remote code execution

9.1.2	Sep 1, 2026	9.1.0 → 9.1.2
9.1.1	Jul 21, 2026	9.1.0 → 9.1.1