Valkey
database10 releases · 0 support lines- Security fixes for use-after-free vulnerabilities in TLS connection handling and stream RDB parsing that could enable remote code execution
- Multiple bug fixes for crashes and undefined behavior in hash field expiration, cluster operations, and 32-bit systems
- Improved throughput with IO threads enabled by offloading object deallocation from the main thread
- Various ACL enforcement improvements and permission bypass fixes
changelog ↗- Three security vulnerabilities fixed: use-after-free in unblock client flow, invalid memory access in RESTORE command, and use-after-free during full sync with Lua/function execution
- Cluster bus network traffic usage now tracked as a metric in bytes
- Reduced latency spikes during hash table rehashing through incremental page release
- Various bug fixes including GEOSEARCH memory leak, stream trim crash, RDMA disconnect crash, and valkey-benchmark memory leak
changelog ↗- Security fixes for use-after-free in TLS connection handling and corrupt stream RDB files that could enable remote code execution
- Strict CRLF validation in RESP protocol parsing to reject malformed requests
- Numerous crash and memory leak fixes across TLS, streams, sorted sets, modules, clustering, and replication
- Improvements to valkey-cli cluster management and configuration handling
changelog ↗- Fixed use-after-free vulnerability in unblock client flow (CVE-2026-23479)
- Fixed invalid memory access vulnerability in RESTORE command (CVE-2026-25243)
- Fixed use-after-free vulnerability when full sync occurs during yielding Lua/function execution (CVE-2026-23631)
changelog ↗- Security fixes for use-after-free in TLS connection handling and corrupt stream RDB files that could enable remote code execution
- Fixed clients being placed on wrong database after module keyspace notifications
- Fixed I/O thread job queue race condition that could crash on ARM/aarch64 systems
- Various fixes for RESTORE payload validation, COMMAND INFO RESP3 output, and cluster configuration injection
changelog ↗- Multiple critical memory safety bugs fixed including heap-use-after-free, double-free, and NULL pointer dereference issues
- Race condition during async client freeing with IO threading enabled resolved
- ZDIFF algorithm memory leak on early exit corrected
- Server crash when RDMA benchmark clients disconnect fixed
changelog ↗- Three security vulnerabilities fixed: use-after-free in client unblock flow, invalid memory access in RESTORE command, and use-after-free during full sync with Lua/function execution
changelog ↗- Security fixes for use-after-free vulnerabilities in TLS connection handling and stream RDB loading that could crash the server
- Multiple crash and memory leak fixes in stream handling, sorted sets, modules, and cluster operations
- Improved protocol validation and rejection of malformed RESP requests and corrupt RDB data
- Enhanced security for configuration injection prevention in Sentinel and cluster nodes
changelog ↗- Fixed use-after-free vulnerability in unblock client flow (CVE-2026-23479)
- Fixed invalid memory access in RESTORE command (CVE-2026-25243)
- Fixed use-after-free when full sync occurs during yielding Lua/function execution (CVE-2026-23631)
changelog ↗- Multiple security vulnerabilities fixed including use-after-free in TLS handling and corrupt stream RDB file handling that could lead to remote code execution
- Memory leaks and crashes fixed in various commands (ZDIFF, ZDIFFSTORE, stream operations, Lua VM)
- Protocol parsing improved to strictly check CRLF and reject malformed input
- File descriptor and memory leaks resolved in blocking connections and module operations
changelog ↗← back to the digest