# Valkey: what changed from 8 to 9

- Product: Valkey (https://whatsnew.fyi/product/valkey)
- Vendor: Linux Foundation
- Range: changelog entries numbered after 8.1.10 up to and including 9.1.2, stable releases only
- Entries below: 6 releases (newest first)
- Resolved: 8 is 8.1.10 and 9 is 9.1.2, the newest stable release of each major we track
- Carrying security changes: 6 · CVEs mentioned: 5 · Mentioning breaking changes: 0 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/valkey/compare/8...9

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (87 changes, grouped by kind)

### Added

#### 9.1.0 (2026-05-19)

- Add cluster bus network traffic usage metric in bytes

### Changed

#### 9.1.1 (2026-07-21)

- Improve throughput when IO threads are enabled by offloading object deallocation from the main thread

#### 9.1.0 (2026-05-19)

- Reduce latency spikes during rehashing via incremental page release

### Fixed

#### 9.0.6 (2026-09-01)

- Fix crashes, assertion failures, and hangs when using RDMA together with IO threads
- Fix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer
- Fix torn RESP3 push frames when a client publishes a large message to a channel it is also subscribed to
- RESET now clears CLIENT IMPORT-SOURCE state so reused pooled connections regain normal key expiration semantics
- Truncated AOF files now discard an incomplete MULTI block entirely, preventing loss of later writes after another restart
- Fix an ACL bypass in GEORADIUS and GEORADIUSBYMEMBER where duplicate STORE options checked only the first destination key
- Fix a use-after-free crash when a cluster message arrives for a message type registered by an unloaded module
- Always deep-validate payloads on RDB load and RESTORE, preventing deferred assertion crashes
- Fix out-of-bounds memory access when registering or receiving cluster module messages of type 255
- AOF loading no longer applies ACL checks, preventing silent data loss when replaying commands with a disabled default user
- Fix a client memory accounting leak that inflated the mem_clients_normal INFO field on replicas after primary disconnects
- Fix a permanent client hang when a blocking command such as BLPOP is pipelined with a partially received next command
- HGETEX now requires write permission on the key, so read-only ACL users can no longer change field TTLs or delete fields
- Compare the full TLS certificate CN when authenticating, so an embedded NUL cannot impersonate a truncated ACL username
- Restore read performance with IO threads on TCP/TLS by applying extra read-completion handling only to RDMA connections
- Restore write performance with IO threads on TCP/TLS by limiting post-write safety checks to RDMA connections
- Fix atomic slot migration protocol errors with IO threads by not offloading export connection writes while snapshotting
- Reject invalid slot import ranges when loading an RDB, preventing corrupted files from creating bad migration state

#### 9.1.2 (2026-09-01)

- Fix a double-free crash when a module timer callback stops its own timer with ValkeyModule_StopTimer
- Fix torn RESP3 push frames when a client publishes to a channel it is also subscribed to
- Listpacks are now always validated on RDB load and RESTORE, preventing deferred assertion crashes
- Fix crashes, hangs, and CPU spinning when the RDMA transport is used together with I/O threads
- RESET now clears the CLIENT IMPORT-SOURCE flag so reused pooled connections return to normal expiration semantics
- Truncate a partially written MULTI block from the AOF on short read, preventing loss of newer writes after a later restart
- Fix an ACL bypass where duplicate STORE/STOREDIST options let GEORADIUS write or delete keys outside the user's permitted patterns
- Fix command log redaction leaking between commands in a MULTI transaction and missing for commands executed from scripts
- Fix a use-after-free crash when a module's cluster message type is received after the module is unloaded
- Fix out-of-bounds access for cluster module message type 255
- AOF loading no longer performs ACL checks on replayed commands, preventing silent data loss when the default user is disabled
- Fix a client memory accounting leak on replicas that inflated the mem_clients_normal INFO field after primary disconnections
- Fix a permanent client deadlock when a blocking command like BLPOP is followed by a partially delivered pipelined command
- HGETEX now requires write permission on the key, closing an ACL gap that let read-only users change field TTLs or delete fields
- Compare the whole TLS certificate CN during authentication so an embedded NUL can no longer impersonate another ACL user
- Fix atomic slot migration failures with I/O threads by not offloading the export job's writes while snapshotting
- Reject invalid slot import ranges when loading an RDB so corrupted files can no longer create bad migration jobs
- Reject RDB slot import records with an invalid job name length, preventing an out-of-bounds read at startup

#### 9.1.1 (2026-07-21)

- Omit the implicit alldbs ACL rule from ACL LIST, ACL SAVE and CONFIG REWRITE so older versions can parse the output
- Fix use-after-free crash when ACL LOAD removes a user whose authenticated client has its close deferred
- Enforce db= ACL permissions on every DB clause of COPY, closing a bypass with REPLACE or repeated DB tokens
- Enforce database-level ACLs for CLUSTER FLUSHSLOT, which removes keys from all databases
- Fix use-after-free in the module API when unregistering the first registered cluster message receiver
- Fix HRANDFIELD with a positive count looping forever when non-expired fields are fewer than the requested count
- Fix clients left on the wrong database after module keyspace notifications for MOVE and COPY
- Fix Sentinel crash during coordinated failover when the command link to the old primary disconnects
- Fix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed
- Fix assertion in HEXPIRE, HGETDEL and HPERSIST when a module blocks the client in a keyspace notification callback
- Fix undefined behavior in the failover delay calculation when cluster-node-timeout is below 30 milliseconds
- Reject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds
- Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion
- Fix corrupted replies caused by a reply buffer race when IO threads are enabled
- Fix startup crash on 32-bit systems where time_t is 64-bit when generating INFO output
- HGETDEL now returns a syntax error when the FIELDS keyword is missing or misplaced
- COMMAND INFO in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands

#### 9.0.5 (2026-07-21)

- Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed
- Fix a use-after-free crash when creating slot import jobs during manual slot migrations
- Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed
- Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type
- Fix a crash from a race between IO threads and asynchronous client freeing
- Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE
- Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted
- Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active
- Fix a NULL pointer crash in TLS pending-data handling
- Fix a server crash when multiple RDMA clients disconnect at the same time
- Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately
- Fix a use-after-free when a module unregisters the first registered cluster message receiver for a message type
- Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count
- Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY
- Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected
- Fix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly
- Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue
- Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket

#### 9.1.0 (2026-05-19)

- Set errno on EOF in syncRead and propagate to conn->last
- Fix GEOSEARCH BYPOLYGON leak on invalid COUNT
- Handle NULL pointer in streamTrim listpack delta calculation
- Fix server crash when RDMA benchmark clients disconnect
- Fix memory leak in valkey-benchmark

### Deprecated

#### 9.0.6 (2026-09-01)

- sanitize-dump-payload is now a deprecated no-op

### Security

#### 9.0.6 (2026-09-01)

- Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL (also in 9.1.2)

#### 9.1.2 (2026-09-01)

- Fix an unauthenticated use-after-free of the Lua interpreter state caused by a process-global script debugger command table

#### 9.1.1 (2026-07-21)

- Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (also in 9.0.5)
- Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution (also in 9.0.5)

#### 9.1.0 (2026-05-19)

- Fix use-after-free in unblock client flow (CVE-2026-23479) (also in 9.0.4)
- Fix invalid memory access in RESTORE command (CVE-2026-25243) (also in 9.0.4)
- Fix use-after-free when full sync occurs during a yielding Lua/function execution (CVE-2026-23631) (also in 9.0.4)

## Release notes

### 9.0.6

- Date: 2026-09-01
- Version: 9.0.6
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.0.6
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.0.6

- **security** — Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL
- **fixed** — Fix crashes, assertion failures, and hangs when using RDMA together with IO threads
- **fixed** — Fix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer
- **fixed** — Fix torn RESP3 push frames when a client publishes a large message to a channel it is also subscribed to
- **fixed** — RESET now clears CLIENT IMPORT-SOURCE state so reused pooled connections regain normal key expiration semantics
- **fixed** — Truncated AOF files now discard an incomplete MULTI block entirely, preventing loss of later writes after another restart
- **fixed** — Fix an ACL bypass in GEORADIUS and GEORADIUSBYMEMBER where duplicate STORE options checked only the first destination key
- **fixed** — Fix a use-after-free crash when a cluster message arrives for a message type registered by an unloaded module
- **fixed** — Always deep-validate payloads on RDB load and RESTORE, preventing deferred assertion crashes
- **deprecated** — sanitize-dump-payload is now a deprecated no-op
- **fixed** — Fix out-of-bounds memory access when registering or receiving cluster module messages of type 255
- **fixed** — AOF loading no longer applies ACL checks, preventing silent data loss when replaying commands with a disabled default user
- **fixed** — Fix a client memory accounting leak that inflated the mem_clients_normal INFO field on replicas after primary disconnects
- **fixed** — Fix a permanent client hang when a blocking command such as BLPOP is pipelined with a partially received next command
- **fixed** — HGETEX now requires write permission on the key, so read-only ACL users can no longer change field TTLs or delete fields
- **fixed** — Compare the full TLS certificate CN when authenticating, so an embedded NUL cannot impersonate a truncated ACL username
- **fixed** — Restore read performance with IO threads on TCP/TLS by applying extra read-completion handling only to RDMA connections
- **fixed** — Restore write performance with IO threads on TCP/TLS by limiting post-write safety checks to RDMA connections
- **fixed** — Fix atomic slot migration protocol errors with IO threads by not offloading export connection writes while snapshotting
- **fixed** — Reject invalid slot import ranges when loading an RDB, preventing corrupted files from creating bad migration state

Valkey 9.0.6  -  Released Tue 01 September 2026
-----------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)

###### Bug Fixes
* Fix crashes, assertion failures, and hangs when using RDMA together with IO threads by @quanyeyang (#3335)
* Fix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
* Fix torn RESP3 push frames when a client publishes a large message to a channel it is also subscribed to by @quanyeyang (#4253)
* RESET now clears CLIENT IMPORT-SOURCE state so reused pooled connections regain normal key expiration semantics by @tjade273 (#3973)
* Truncated AOF files now discard an incomplete MULTI block entirely, preventing loss of later writes after another restart by @chzhoo (#4342)
* Fix an ACL bypass in GEORADIUS and GEORADIUSBYMEMBER where duplicate STORE options checked only the first destination key by @tjade273 (#3971)
* Fix a use-after-free crash when a cluster message arrives for a message type registered by an unloaded module by @enjoy-binbin (#4360)
* Always deep-validate payloads on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload is now a deprecated no-op by @jjuleslasarte (#3721)
* Fix out-of-bounds memory access when registering or receiving cluster module messages of type 255, which is now a valid type by @enjoy-binbin (#4410)
* AOF loading no longer applies ACL checks, preventing silent data loss when replaying commands with a disabled default user by @lukepalmer (#3984)
* Fix a client memory accounting leak that inflated the mem_clients_normal INFO field on replicas after primary disconnects by @enjoy-binbin (#4395)
* Fix a permanent client hang when a blocking command such as BLPOP is pipelined with a partially received next command by @foobar (#4531)
* HGETEX now requires write permission on the key, so read-only ACL users can no longer change field TTLs or delete fields by @ranshid (#4576)
* Compare the full TLS certificate CN when authenticating, so an embedded NUL cannot impersonate a truncated ACL username by @madolson (#4577)
* Restore read performance with IO threads on TCP/TLS by applying extra read-completion handling only to RDMA connections by @quanyeyang (#4414)
* Restore write performance with IO threads on TCP/TLS by limiting post-write safety checks to RDMA connections by @quanyeyang (#4452)
* Fix atomic slot migration protocol errors with IO threads by not offloading export connection writes while snapshotting by @satheeshaGowda (#4104)
* Reject invalid slot import ranges when loading an RDB, preventing corrupted files from creating bad migration state by @enjoy-binbin (#4229)
* Reject RDB slot-import records with an invalid job name length, fixing an out-of-bounds read during startup by @quanyeyang (#4210)
* Fix a crash when COPY ends with a bare DB token during slot migration, and block cross-DB COPY regardless of option order by @madolson (#4301)
* HPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a syntax error when the FIELDS keyword is missing by @cjx-zar (#4300)
* Fix a TLS and IO threads race that could leave slot migration export jobs stuck until timeout by @jjuleslasarte (#4320)
* Fix a server crash when hash field expirations are set near the maximum timestamp, for example via HPEXPIREAT by @ranshid (#4312)
* Fix a stack overflow crash on TLS connections when retrying a failed write of large replies by @murphyjacob4 (#4307)
* Validate cluster bus PUBLISH and MODULE packet payload lengths, preventing a remote crash from forged length fields by @tjade273 (#3972)
* Fix a use-after-free

_[Truncated at 4000 characters — full notes: https://github.com/valkey-io/valkey/releases/tag/9.0.6]_

### 9.1.2

- Date: 2026-09-01
- Version: 9.1.2
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.1.2
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.1.2

- **security** — Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL
- **security** — Fix an unauthenticated use-after-free of the Lua interpreter state caused by a process-global script debugger command table
- **fixed** — Fix a double-free crash when a module timer callback stops its own timer with ValkeyModule_StopTimer
- **fixed** — Fix torn RESP3 push frames when a client publishes to a channel it is also subscribed to
- **fixed** — Listpacks are now always validated on RDB load and RESTORE, preventing deferred assertion crashes
- **fixed** — Fix crashes, hangs, and CPU spinning when the RDMA transport is used together with I/O threads
- **fixed** — RESET now clears the CLIENT IMPORT-SOURCE flag so reused pooled connections return to normal expiration semantics
- **fixed** — Truncate a partially written MULTI block from the AOF on short read, preventing loss of newer writes after a later restart
- **fixed** — Fix an ACL bypass where duplicate STORE/STOREDIST options let GEORADIUS write or delete keys outside the user's permitted patterns
- **fixed** — Fix command log redaction leaking between commands in a MULTI transaction and missing for commands executed from scripts
- **fixed** — Fix a use-after-free crash when a module's cluster message type is received after the module is unloaded
- **fixed** — Fix out-of-bounds access for cluster module message type 255
- **fixed** — AOF loading no longer performs ACL checks on replayed commands, preventing silent data loss when the default user is disabled
- **fixed** — Fix a client memory accounting leak on replicas that inflated the mem_clients_normal INFO field after primary disconnections
- **fixed** — Fix a permanent client deadlock when a blocking command like BLPOP is followed by a partially delivered pipelined command
- **fixed** — HGETEX now requires write permission on the key, closing an ACL gap that let read-only users change field TTLs or delete fields
- **fixed** — Compare the whole TLS certificate CN during authentication so an embedded NUL can no longer impersonate another ACL user
- **fixed** — Fix atomic slot migration failures with I/O threads by not offloading the export job's writes while snapshotting
- **fixed** — Reject invalid slot import ranges when loading an RDB so corrupted files can no longer create bad migration jobs
- **fixed** — Reject RDB slot import records with an invalid job name length, preventing an out-of-bounds read at startup

Valkey 9.1.2  -  Released Mon 31 August 2026
--------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
* GHSA-fq2f-crmw-q97r: Fix an unauthenticated use-after-free of the Lua interpreter state, caused by a process-global script debugger command table that cached a raw pointer to a freed interpreter and was never invalidated (#4574)

###### Bug Fixes
* Fix a double-free crash when a module timer callback stops its own timer with `ValkeyModule_StopTimer` by @quanyeyang (#4211)
* Fix torn RESP3 push frames when a client publishes to a channel it is also subscribed to, which could desync client libraries by @quanyeyang (#4253)
* Listpacks are now always validated on RDB load and RESTORE, preventing deferred assertion crashes; `sanitize-dump-payload` and its ACL flags become no-ops by @jjuleslasarte (#3721)
* Fix crashes, hangs, and CPU spinning when the RDMA transport is used together with I/O threads by @quanyeyang (#3611)
* RESET now clears the `CLIENT IMPORT-SOURCE` flag, so reused pooled connections return to normal expiration semantics by @tjade273 (#3973)
* Truncate a partially written MULTI block from the AOF on short read, preventing loss of newer writes after a later restart by @chzhoo (#4342)
* Fix an ACL bypass where duplicate STORE/STOREDIST options let GEORADIUS write or delete keys outside the user's permitted patterns by @tjade273 (#3971)
* Fix command log redaction leaking between commands in a MULTI transaction and missing for commands executed from scripts by @madolson (#4323)
* Fix a use-after-free crash when a module's cluster message type is received after the module is unloaded by @enjoy-binbin (#4360)
* Fix out-of-bounds access for cluster module message type 255, which is now a valid, dispatchable message type by @enjoy-binbin (#4410)
* AOF loading no longer performs ACL checks on replayed commands, preventing silent data loss when the default user is disabled by @lukepalmer (#3984)
* Fix a client memory accounting leak on replicas that inflated the `mem_clients_normal` INFO field after primary disconnections by @enjoy-binbin (#4395)
* Fix a permanent client deadlock when a blocking command like BLPOP is followed by a partially delivered pipelined command by @foobar (#4531)
* HGETEX now requires write permission on the key, closing an ACL gap that let read-only users change field TTLs or delete fields by @ranshid (#4576)
* Compare the whole TLS certificate CN during authentication, so an embedded NUL can no longer impersonate another ACL user by @madolson (#4577)
* Fix atomic slot migration failures with I/O threads by not offloading the export job's writes while snapshotting by @satheeshaGowda (#4104)
* Reject invalid slot import ranges when loading an RDB, so corrupted files can no longer create bad migration jobs by @enjoy-binbin (#4229)
* Reject RDB slot import records with an invalid job name length, preventing an out-of-bounds read at startup by @quanyeyang (#4210)
* MOVE and COPY now check ACL access to the current database, so users can no longer exfiltrate keys from an unauthorized DB by @cjx-zar (#4155)
* Fix a crash on COPY with a trailing DB option during slot migration, and block cross-DB COPY regardless of option order by @madolson (#4301)
* Fix a server panic when pipelined commands with invalid arity reach the key prefetcher with I/O threads enabled by @madolson (#4302)
* HPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a syntax error when the FIELDS keyword is missing by @cjx-zar (#4300)
* Fix a race between TLS I/O-thread writes and reads that could leave slot migration export jobs stuck until

_[Truncated at 4000 characters — full notes: https://github.com/valkey-io/valkey/releases/tag/9.1.2]_

### 9.1.1

- Date: 2026-07-21
- Version: 9.1.1
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.1.1
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.1.1

- **security** — Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL
- **security** — Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution
- **fixed** — Omit the implicit alldbs ACL rule from ACL LIST, ACL SAVE and CONFIG REWRITE so older versions can parse the output
- **changed** — Improve throughput when IO threads are enabled by offloading object deallocation from the main thread
- **fixed** — Fix use-after-free crash when ACL LOAD removes a user whose authenticated client has its close deferred
- **fixed** — Enforce db= ACL permissions on every DB clause of COPY, closing a bypass with REPLACE or repeated DB tokens
- **fixed** — Enforce database-level ACLs for CLUSTER FLUSHSLOT, which removes keys from all databases
- **fixed** — Fix use-after-free in the module API when unregistering the first registered cluster message receiver
- **fixed** — Fix HRANDFIELD with a positive count looping forever when non-expired fields are fewer than the requested count
- **fixed** — Fix clients left on the wrong database after module keyspace notifications for MOVE and COPY
- **fixed** — Fix Sentinel crash during coordinated failover when the command link to the old primary disconnects
- **fixed** — Fix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed
- **fixed** — Fix assertion in HEXPIRE, HGETDEL and HPERSIST when a module blocks the client in a keyspace notification callback
- **fixed** — Fix undefined behavior in the failover delay calculation when cluster-node-timeout is below 30 milliseconds
- **fixed** — Reject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds
- **fixed** — Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion
- **fixed** — Fix corrupted replies caused by a reply buffer race when IO threads are enabled
- **fixed** — Fix startup crash on 32-bit systems where time_t is 64-bit when generating INFO output
- **fixed** — HGETDEL now returns a syntax error when the FIELDS keyword is missing or misplaced
- **fixed** — COMMAND INFO in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands

Valkey 9.1.1  -  Released Tue 21 July 2026
------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
* CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

###### Bug Fixes
* Omit the implicit `alldbs` ACL rule from `ACL LIST`, `ACL SAVE` and `CONFIG REWRITE` so older versions can parse the output by @dvkashapov (#3964)
* Improve throughput when IO threads are enabled by offloading object deallocation from the main thread by @roshkhatri (#3938)
* Fix use-after-free crash when `ACL LOAD` removes a user whose authenticated client has its close deferred by @ranshid (#3800)
* Enforce `db=` ACL permissions on every DB clause of `COPY`, closing a bypass with `REPLACE` or repeated DB tokens by @enjoy-binbin (#3801)
* Enforce database-level ACLs for `CLUSTER FLUSHSLOT`, which removes keys from all databases by @enjoy-binbin (#3806)
* Fix use-after-free in the module API when unregistering the first registered cluster message receiver by @eifrah-aws (#3846)
* Fix `HRANDFIELD` with a positive count looping forever when non-expired fields are fewer than the requested count by @cjx-zar (#4047)
* Fix clients left on the wrong database after module keyspace notifications for `MOVE` and `COPY` by @enjoy-binbin (#4024)
* Fix Sentinel crash during coordinated failover when the command link to the old primary disconnects by @lukepalmer (#4068)
* Fix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed by @ranshid (#3950)
* Fix assertion in `HEXPIRE`, `HGETDEL` and `HPERSIST` when a module blocks the client in a keyspace notification callback by @enjoy-binbin (#3743)
* Fix undefined behavior in the failover delay calculation when `cluster-node-timeout` is below 30 milliseconds by @enjoy-binbin (#3941)
* Reject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
* Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion by @madolson (#3921)
* Fix corrupted replies (dropped leading bytes) caused by a reply buffer race when IO threads are enabled by @nanyan0312 (#4060)
* Fix startup crash on 32-bit systems where time_t is 64-bit (such as Alpine 3.23) when generating `INFO` output by @chenshi5012 (#3787)
* `HGETDEL` now returns a syntax error when the `FIELDS` keyword is missing or misplaced by @lcxn123 (#4049)
* `COMMAND INFO` in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands by @rickrams (#3939)
* Send the replica version on the dual-channel RDB connection so full syncs with newer encodings like hash field TTLs succeed by @hpatro (#4105)
* Fix duplicate failure handling and an invalid reply sequence in cluster slot migration by @chx9 (#3723)
* Reject control characters in `SENTINEL SET` values to prevent config-file injection via Sentinel config rewrite by @eifrah-aws (#3847)
* Reject control characters and delimiters in cluster AUX fields and validate `cluster-announce-ip` to prevent nodes.conf injection by @eifrah-aws (#3848)
* Redact key names and user data from more server log messages when `hide-user-data-from-log` is enabled by @zackcam (#3872)
* `ACL LOG` now reports the denied database ID for `COPY` instead of the command name when `db=` access is denied by @enjoy-binbin (#3888)
* Fix garbled shard IDs in the cluster UPDATE message log line by @enjoy-binbin (#3942)
* Fix negative `master_sync_total_bytes` in `INFO replication` during disk-based sync wh

_[Truncated at 4000 characters — full notes: https://github.com/valkey-io/valkey/releases/tag/9.1.1]_

### 9.0.5

- Date: 2026-07-21
- Version: 9.0.5
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.0.5
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.0.5

- **security** — Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL
- **security** — Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution
- **fixed** — Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed
- **fixed** — Fix a use-after-free crash when creating slot import jobs during manual slot migrations
- **fixed** — Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed
- **fixed** — Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type
- **fixed** — Fix a crash from a race between IO threads and asynchronous client freeing
- **fixed** — Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE
- **fixed** — Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted
- **fixed** — Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active
- **fixed** — Fix a NULL pointer crash in TLS pending-data handling
- **fixed** — Fix a server crash when multiple RDMA clients disconnect at the same time
- **fixed** — Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately
- **fixed** — Fix a use-after-free when a module unregisters the first registered cluster message receiver for a message type
- **fixed** — Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count
- **fixed** — Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY
- **fixed** — Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected
- **fixed** — Fix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly
- **fixed** — Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue
- **fixed** — Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket

Valkey 9.0.5  -  Released Tue 21 July 2026
------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
* CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

###### Bug Fixes
* Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed by @enjoy-binbin (#2872)
* Fix a use-after-free crash when creating slot import jobs during manual slot migrations by @twooster (#3283)
* Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed by @sarthakaggarwal97 (#3342)
* Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type by @madolson (#3516)
* Fix a crash from a race between IO threads and asynchronous client freeing by @deepakrn (#3458)
* Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE by @enjoy-binbin (#3498)
* Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted by @smkher (#3591)
* Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active by @eifrah-aws (#3578)
* Fix a NULL pointer crash in TLS pending-data handling by @zuiderkwast (#3641)
* Fix a server crash when multiple RDMA clients disconnect at the same time by @quanyeyang (#3448)
* Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately by @ranshid (#3800)
* Fix a use-after-free when a module unregisters the first registered cluster message receiver for a message type by @eifrah-aws (#3846)
* Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count by @cjx-zar (#4047)
* Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY by @enjoy-binbin (#4024)
* Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected by @lukepalmer (#4068)
* Fix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly by @dvkashapov (#3306)
* Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue by @jjuleslasarte (#3878)
* Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket by @ranshid (#3950)
* Fix a file descriptor leak when a blocking connection attempt, such as MIGRATE to an unreachable host, times out by @madolson (#3541)
* Fix a potential crash from a dangling slot migration job reference when the migration client is reset by @murphyjacob4 (#3554)
* Remove cached EVAL scripts when their scripting engine is unregistered, preventing dangling engine references by @eifrah-aws (#3503)
* Fix a memory leak in GEOSEARCH BYPOLYGON when argument parsing fails, such as on an invalid COUNT by @bandalgomsu (#3568)
* Fix a crash when a slot migration target node is removed from the cluster before the migration connects by @chenshi5012 (#3596)
* Fix a crash when the module GetLRU/SetLRU/GetLFU/SetLFU APIs are called with a NULL key by @yaronsananes (#3610)
* Fix an assertion failure in hash field expiration commands when a module blocks the client in a keyspace notification by @enjoy-binbin (#3743)
* Fix a cluster UPDATE log message reading shard IDs past their fixed-length buffer by @enjoy-binbin (#3942)
* Fix undefined behavior in the failover delay calculation when cluster-node-timeout is set below 30 mil

_[Truncated at 4000 characters — full notes: https://github.com/valkey-io/valkey/releases/tag/9.0.5]_

### 9.1.0

- Date: 2026-05-19
- Version: 9.1.0
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.1.0
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.1.0

- **security** — Fix use-after-free in unblock client flow (CVE-2026-23479)
- **security** — Fix invalid memory access in RESTORE command (CVE-2026-25243)
- **security** — Fix use-after-free when full sync occurs during a yielding Lua/function execution (CVE-2026-23631)
- **added** — Add cluster bus network traffic usage metric in bytes
- **changed** — Reduce latency spikes during rehashing via incremental page release
- **fixed** — Set errno on EOF in syncRead and propagate to conn->last
- **fixed** — Fix GEOSEARCH BYPOLYGON leak on invalid COUNT
- **fixed** — Handle NULL pointer in streamTrim listpack delta calculation
- **fixed** — Fix server crash when RDMA benchmark clients disconnect
- **fixed** — Fix memory leak in valkey-benchmark

Upgrade urgency LOW: This is the first stable release of Valkey 9.1.

###### Security fixes

* (CVE-2026-23479) Use-After-Free in unblock client flow
* (CVE-2026-25243) Invalid Memory Access in RESTORE command
* (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

###### New Features and enhanced behavior
* Add cluster bus network traffic usage metric in bytes by @hpatro (#3396)
* Reduce latency spikes during rehashing via incremental page release by @chzhoo (#3481)

###### Bug Fixes
* Fix(syncio): Set errno on EOF in syncRead and propagate to conn->last by @abmathur-ie (#3580)
* Fix GEOSEARCH BYPOLYGON leak on invalid COUNT by @bandalgomsu (#3568)
* Handle NULL pointer in streamTrim listpack delta calculation by @smkher (#3591)
* Fixes server crash when RDMA benchmark clients disconnect by @quanyeyang (#3448)
* Fix the memory leak in valkey-benchmark by @nmvk (#3643)

See also the release notes for 9.1.0-rc1 and 9.1.0-rc2.

### 9.0.4

- Date: 2026-05-06
- Version: 9.0.4
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.0.4
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.0.4

- **security** — Fix use-after-free in unblock client flow (CVE-2026-23479)
- **security** — Fix invalid memory access in RESTORE command (CVE-2026-25243)
- **security** — Fix use-after-free when full sync occurs during a yielding Lua/function execution (CVE-2026-23631)

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

###### Security fixes

* (CVE-2026-23479) Use-After-Free in unblock client flow
* (CVE-2026-25243) Invalid Memory Access in RESTORE command
* (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution