# Valkey changelog

> A high-performance key-value datastore.

- Vendor: Linux Foundation
- Category: Developer Tools
- Official site: https://valkey.io
- Tracked by: What's New (https://whatsnew.fyi/product/valkey)
- Harvested from: GitHub (valkey-io/valkey)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### 9.1.1

- Date: 2026-07-21
- Version: 9.1.1
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.1.1
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.1.1

- **security** — Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL
- **security** — Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution
- **fixed** — Omit the implicit alldbs ACL rule from ACL LIST, ACL SAVE and CONFIG REWRITE so older versions can parse the output
- **changed** — Improve throughput when IO threads are enabled by offloading object deallocation from the main thread
- **fixed** — Fix use-after-free crash when ACL LOAD removes a user whose authenticated client has its close deferred
- **fixed** — Enforce db= ACL permissions on every DB clause of COPY, closing a bypass with REPLACE or repeated DB tokens
- **fixed** — Enforce database-level ACLs for CLUSTER FLUSHSLOT, which removes keys from all databases
- **fixed** — Fix use-after-free in the module API when unregistering the first registered cluster message receiver
- **fixed** — Fix HRANDFIELD with a positive count looping forever when non-expired fields are fewer than the requested count
- **fixed** — Fix clients left on the wrong database after module keyspace notifications for MOVE and COPY
- **fixed** — Fix Sentinel crash during coordinated failover when the command link to the old primary disconnects
- **fixed** — Fix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed
- **fixed** — Fix assertion in HEXPIRE, HGETDEL and HPERSIST when a module blocks the client in a keyspace notification callback
- **fixed** — Fix undefined behavior in the failover delay calculation when cluster-node-timeout is below 30 milliseconds
- **fixed** — Reject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds
- **fixed** — Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion
- **fixed** — Fix corrupted replies caused by a reply buffer race when IO threads are enabled
- **fixed** — Fix startup crash on 32-bit systems where time_t is 64-bit when generating INFO output
- **fixed** — HGETDEL now returns a syntax error when the FIELDS keyword is missing or misplaced
- **fixed** — COMMAND INFO in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands

Valkey 9.1.1  -  Released Tue 21 July 2026
------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
* CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

###### Bug Fixes
* Omit the implicit `alldbs` ACL rule from `ACL LIST`, `ACL SAVE` and `CONFIG REWRITE` so older versions can parse the output by @dvkashapov (#3964)
* Improve throughput when IO threads are enabled by offloading object deallocation from the main thread by @roshkhatri (#3938)
* Fix use-after-free crash when `ACL LOAD` removes a user whose authenticated client has its close deferred by @ranshid (#3800)
* Enforce `db=` ACL permissions on every DB clause of `COPY`, closing a bypass with `REPLACE` or repeated DB tokens by @enjoy-binbin (#3801)
* Enforce database-level ACLs for `CLUSTER FLUSHSLOT`, which removes keys from all databases by @enjoy-binbin (#3806)
* Fix use-after-free in the module API when unregistering the first registered cluster message receiver by @eifrah-aws (#3846)
* Fix `HRANDFIELD` with a positive count looping forever when non-expired fields are fewer than the requested count by @cjx-zar (#4047)
* Fix clients left on the wrong database after module keyspace notifications for `MOVE` and `COPY` by @enjoy-binbin (#4024)
* Fix Sentinel crash during coordinated failover when the command link to the old primary disconnects by @lukepalmer (#4068)
* Fix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed by @ranshid (#3950)
* Fix assertion in `HEXPIRE`, `HGETDEL` and `HPERSIST` when a module blocks the client in a keyspace notification callback by @enjoy-binbin (#3743)
* Fix undefined behavior in the failover delay calculation when `cluster-node-timeout` is below 30 milliseconds by @enjoy-binbin (#3941)
* Reject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
* Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion by @madolson (#3921)
* Fix corrupted replies (dropped leading bytes) caused by a reply buffer race when IO threads are enabled by @nanyan0312 (#4060)
* Fix startup crash on 32-bit systems where time_t is 64-bit (such as Alpine 3.23) when generating `INFO` output by @chenshi5012 (#3787)
* `HGETDEL` now returns a syntax error when the `FIELDS` keyword is missing or misplaced by @lcxn123 (#4049)
* `COMMAND INFO` in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands by @rickrams (#3939)
* Send the replica version on the dual-channel RDB connection so full syncs with newer encodings like hash field TTLs succeed by @hpatro (#4105)
* Fix duplicate failure handling and an invalid reply sequence in cluster slot migration by @chx9 (#3723)
* Reject control characters in `SENTINEL SET` values to prevent config-file injection via Sentinel config rewrite by @eifrah-aws (#3847)
* Reject control characters and delimiters in cluster AUX fields and validate `cluster-announce-ip` to prevent nodes.conf injection by @eifrah-aws (#3848)
* Redact key names and user data from more server log messages when `hide-user-data-from-log` is enabled by @zackcam (#3872)
* `ACL LOG` now reports the denied database ID for `COPY` instead of the command name when `db=` access is denied by @enjoy-binbin (#3888)
* Fix garbled shard IDs in the cluster UPDATE message log line by @enjoy-binbin (#3942)
* Fix negative `master_sync_total_bytes` in `INFO replication` during disk-based sync wh

_[Truncated at 4000 characters — full notes: https://github.com/valkey-io/valkey/releases/tag/9.1.1]_

### 9.0.5

- Date: 2026-07-21
- Version: 9.0.5
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.0.5
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.0.5

- **security** — Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL
- **security** — Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution
- **fixed** — Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed
- **fixed** — Fix a use-after-free crash when creating slot import jobs during manual slot migrations
- **fixed** — Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed
- **fixed** — Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type
- **fixed** — Fix a crash from a race between IO threads and asynchronous client freeing
- **fixed** — Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE
- **fixed** — Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted
- **fixed** — Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active
- **fixed** — Fix a NULL pointer crash in TLS pending-data handling
- **fixed** — Fix a server crash when multiple RDMA clients disconnect at the same time
- **fixed** — Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately
- **fixed** — Fix a use-after-free when a module unregisters the first registered cluster message receiver for a message type
- **fixed** — Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count
- **fixed** — Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY
- **fixed** — Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected
- **fixed** — Fix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly
- **fixed** — Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue
- **fixed** — Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket

Valkey 9.0.5  -  Released Tue 21 July 2026
------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
* CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

###### Bug Fixes
* Strictly validate CRLF terminators when parsing the RESP protocol; malformed requests now get a protocol error instead of being misparsed by @enjoy-binbin (#2872)
* Fix a use-after-free crash when creating slot import jobs during manual slot migrations by @twooster (#3283)
* Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty before all inputs are processed by @sarthakaggarwal97 (#3342)
* Fix HPERSIST sending a malformed reply that desynchronized the connection when used on a key of the wrong type by @madolson (#3516)
* Fix a crash from a race between IO threads and asynchronous client freeing by @deepakrn (#3458)
* Fix a double free when loading a stream with corrupt consumer PEL data from RDB or RESTORE by @enjoy-binbin (#3498)
* Fix listpack corruption and a subsequent crash when XTRIM marks the last entry of a stream listpack node as deleted by @smkher (#3591)
* Fix malformed replies when module callbacks build deferred-length arrays while a client's deferred reply buffer is active by @eifrah-aws (#3578)
* Fix a NULL pointer crash in TLS pending-data handling by @zuiderkwast (#3641)
* Fix a server crash when multiple RDMA clients disconnect at the same time by @quanyeyang (#3448)
* Fix a use-after-free when ACL LOAD deletes a user whose clients cannot be freed immediately by @ranshid (#3800)
* Fix a use-after-free when a module unregisters the first registered cluster message receiver for a message type by @eifrah-aws (#3846)
* Fix HRANDFIELD looping forever when a hash has fewer non-expired fields than the requested count by @cjx-zar (#4047)
* Fix clients being left on the wrong database after module keyspace notifications for commands like MOVE and COPY by @enjoy-binbin (#4024)
* Fix a Sentinel crash during coordinated failover when the connection to the old primary is disconnected by @lukepalmer (#4068)
* Fix underestimation of client output buffer memory when replies reference shared objects, so buffer limits are enforced correctly by @dvkashapov (#3306)
* Fix a crash on ARM/aarch64 caused by memory-ordering races in the IO thread job queue by @jjuleslasarte (#3878)
* Fix a crash when active hash field expiration leaves a single entry in a large expiration time-bucket by @ranshid (#3950)
* Fix a file descriptor leak when a blocking connection attempt, such as MIGRATE to an unreachable host, times out by @madolson (#3541)
* Fix a potential crash from a dangling slot migration job reference when the migration client is reset by @murphyjacob4 (#3554)
* Remove cached EVAL scripts when their scripting engine is unregistered, preventing dangling engine references by @eifrah-aws (#3503)
* Fix a memory leak in GEOSEARCH BYPOLYGON when argument parsing fails, such as on an invalid COUNT by @bandalgomsu (#3568)
* Fix a crash when a slot migration target node is removed from the cluster before the migration connects by @chenshi5012 (#3596)
* Fix a crash when the module GetLRU/SetLRU/GetLFU/SetLFU APIs are called with a NULL key by @yaronsananes (#3610)
* Fix an assertion failure in hash field expiration commands when a module blocks the client in a keyspace notification by @enjoy-binbin (#3743)
* Fix a cluster UPDATE log message reading shard IDs past their fixed-length buffer by @enjoy-binbin (#3942)
* Fix undefined behavior in the failover delay calculation when cluster-node-timeout is set below 30 mil

_[Truncated at 4000 characters — full notes: https://github.com/valkey-io/valkey/releases/tag/9.0.5]_

### 8.1.9

- Date: 2026-07-21
- Version: 8.1.9
- Original notes: https://github.com/valkey-io/valkey/releases/tag/8.1.9
- Permalink: https://whatsnew.fyi/product/valkey/releases/8.1.9

- **security** — Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (CVE-2026-56684)
- **security** — Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution (CVE-2026-63639)
- **fixed** — Fix clients being left on the wrong database after module keyspace notifications from commands like MOVE and COPY
- **fixed** — Fix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64
- **fixed** — Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds
- **fixed** — Reject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted RESTORE payloads
- **fixed** — Fix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit (e.g. Alpine time64)
- **fixed** — Fix COMMAND INFO in RESP3 to reply with an empty Array instead of a Set for commands without subcommands
- **fixed** — Reject invalid characters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf corruption and injection
- **fixed** — Fix lua-enable-insecure-api having no effect when enabled at startup via config file or command line
- **changed** — Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths

Valkey 8.1.9  -  Released Tue 21 July 2026
------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
* CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

###### Bug Fixes
* Fix clients being left on the wrong database after module keyspace notifications from commands like `MOVE` and `COPY` by @enjoy-binbin (#4024)
* Fix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64 by @jjuleslasarte (#3878)
* Reject zipmap `RESTORE` payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
* Reject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted `RESTORE` payloads by @madolson (#3921)
* Fix a startup crash when generating `INFO` output on 32-bit systems where `time_t` is 64-bit (e.g. Alpine time64) by @chenshi5012 (#3787)
* Fix `COMMAND INFO` in RESP3 to reply with an empty Array instead of a Set for commands without subcommands by @rickrams (#3939)
* Reject invalid characters in cluster AUX fields and `cluster-announce-ip` to prevent `nodes.conf` corruption and injection by @eifrah-aws (#3848)
* Fix `lua-enable-insecure-api` having no effect when enabled at startup via config file or command line by @enjoy-binbin (#3548)
* Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)

**Full Changelog**: https://github.com/valkey-io/valkey/compare/8.1.8...8.1.9

### 8.0.10

- Date: 2026-07-21
- Version: 8.0.10
- Original notes: https://github.com/valkey-io/valkey/releases/tag/8.0.10
- Permalink: https://whatsnew.fyi/product/valkey/releases/8.0.10

- **security** — Fix use-after-free in TLS connection handling that could allow an authenticated client to crash the server using CLIENT KILL
- **security** — Reject corrupt stream RDB files containing a shared NACK across consumers
- **fixed** — Strictly validate CRLF line endings when parsing the RESP protocol, rejecting malformed requests as protocol errors
- **fixed** — Fix memory leak in ZDIFF/ZDIFFSTORE when the result set becomes empty before all input sets are processed
- **fixed** — Fix crash caused by a race between asynchronous client freeing and IO threads reading from the closing client
- **fixed** — Fix double free when loading corrupt stream RDB data containing duplicate consumer PEL entries
- **fixed** — Fix stream corruption and crash when XTRIM marks the last entry of a listpack node as deleted
- **fixed** — Fix potential crash in TLS pending-data handling when the connection has no SSL object
- **fixed** — Fix use-after-free when ACL LOAD removes a user whose authenticated client's free is deferred
- **fixed** — Fix use-after-free when a module unregisters the first-registered cluster message receiver for a message type
- **fixed** — Fix crash when loading functions after FUNCTION FLUSH ASYNC and make FUNCTION FLUSH actually release Lua VM memory
- **fixed** — Fix file descriptor leak when a blocking connect times out, such as MIGRATE to an unreachable host
- **fixed** — Fix crash in module LRU/LFU API functions (GetLRU, SetLRU, GetLFU, SetLFU) when passed a NULL key
- **fixed** — TLS synchronous I/O no longer leaves a blocking socket in non-blocking mode, preventing unexpected short reads
- **fixed** — Fix crash when CLUSTER SLOTS is called without a real client connection, such as from a module timer callback
- **fixed** — Fix assertion crash in the IO thread job queue on ARM/aarch64 caused by memory store reordering
- **fixed** — Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds
- **fixed** — Reject NAN scores in listpack and ziplist encoded sorted sets on RDB load, preventing a later crash on skiplist conversion
- **fixed** — Fix crash on 32-bit systems where time_t is 64-bit when generating INFO output
- **fixed** — COMMAND INFO in RESP3 now returns an empty Array instead of a Set for the subcommands field of commands without subcommands

Valkey 8.0.10  -  Released Tue 21 July 2026
-------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to crash the server using CLIENT KILL (#4234)
* CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers. Reported by @z0v3r1n and @lifip. (#4073)

###### Bug Fixes
* Strictly validate CRLF line endings when parsing the RESP protocol, rejecting malformed requests as protocol errors by @enjoy-binbin (#2872)
* Fix memory leak in `ZDIFF`/`ZDIFFSTORE` when the result set becomes empty before all input sets are processed by @sarthakaggarwal97 (#3342)
* Fix crash caused by a race between asynchronous client freeing and IO threads reading from the closing client by @deepakrn (#3458)
* Fix double free when loading corrupt stream RDB data containing duplicate consumer PEL entries by @enjoy-binbin (#3498)
* Fix stream corruption and crash when `XTRIM` marks the last entry of a listpack node as deleted by @smkher (#3591)
* Fix potential crash in TLS pending-data handling when the connection has no SSL object by @zuiderkwast (#3641)
* Fix use-after-free when `ACL LOAD` removes a user whose authenticated client's free is deferred by @ranshid (#3800)
* Fix use-after-free when a module unregisters the first-registered cluster message receiver for a message type by @eifrah-aws (#3846)
* Fix crash when loading functions after `FUNCTION FLUSH ASYNC` and make `FUNCTION FLUSH` actually release Lua VM memory by @enjoy-binbin (#1826)
* Fix file descriptor leak when a blocking connect times out, such as `MIGRATE` to an unreachable host by @madolson (#3541)
* Fix crash in module LRU/LFU API functions (GetLRU, SetLRU, GetLFU, SetLFU) when passed a NULL key by @yaronsananes (#3610)
* TLS synchronous I/O no longer leaves a blocking socket in non-blocking mode, preventing unexpected short reads by @xbasel (#1298)
* Fix crash when `CLUSTER SLOTS` is called without a real client connection, such as from a module timer callback by @bandalgomsu (#2915)
* Fix assertion crash in the IO thread job queue on ARM/aarch64 caused by memory store reordering by @jjuleslasarte (#3878)
* Reject zipmap `RESTORE` payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
* Reject NAN scores in listpack and ziplist encoded sorted sets on RDB load, preventing a later crash on skiplist conversion by @madolson (#3921)
* Fix crash on 32-bit systems where time_t is 64-bit (e.g. Alpine with time64) when generating INFO output by @chenshi5012 (#3787)
* `COMMAND INFO` in RESP3 now returns an empty Array instead of a Set for the subcommands field of commands without subcommands by @rickrams (#3939)
* Manual failover votes are no longer restricted by two times the node timeout, preventing manual failover timeouts by @enjoy-binbin (#1305)
* Automatic failover votes are no longer restricted by two times the node timeout, matching the manual failover change by @enjoy-binbin (#1356)
* `SENTINEL SET` now rejects values containing control characters and config rewrite escapes them, preventing config injection by @eifrah-aws (#3847)
* Reject control characters and delimiters in cluster AUX fields and `cluster-announce-ip` to prevent nodes.conf injection by @eifrah-aws (#3848)
* Fix `lua-enable-insecure-api yes` not taking effect when set at startup via config file or command line by @enjoy-binbin (#3548)
* Log 'Connection reset by peer' instead of the misleading 'Success' when the connection to the primary closes during sync by @abmathur-ie (#3580)
* Redact key names and user data from additional server log messages when `hide-user-data-from-log` is enabled by @zackcam (#3872)
* Increase the maximum process title length from 255 to 1024 characters

_[Truncated at 4000 characters — full notes: https://github.com/valkey-io/valkey/releases/tag/8.0.10]_

### 7.2.14

- Date: 2026-07-21
- Version: 7.2.14
- Original notes: https://github.com/valkey-io/valkey/releases/tag/7.2.14
- Permalink: https://whatsnew.fyi/product/valkey/releases/7.2.14

- **security** — Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (CVE-2026-56684)
- **security** — Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution (CVE-2026-63639)
- **security** — Fix invalid memory access when loading a malformed zipmap payload via RESTORE (CVE-2026-25243)
- **fixed** — Strictly check CRLF when parsing requests and reject malformed input as a protocol error instead of misparsing it
- **fixed** — Fix a memory leak in ZDIFF and ZDIFFSTORE when the result set becomes empty during computation
- **fixed** — Fix a double free when loading a stream consumer group from a corrupted RDB or RESTORE payload
- **fixed** — Fix a potential crash from a NULL pointer dereference when updating the TLS pending-data flag
- **fixed** — Fix a Lua VM crash when loading functions after FUNCTION FLUSH ASYNC and ensure flushed scripts' memory is released
- **fixed** — Fix a use-after-free when a module unregisters and re-registers a cluster message receiver
- **fixed** — Fix a file descriptor leak when a blocking connection attempt times out, e.g. during MIGRATE to an unreachable host
- **fixed** — Fix a crash in the module API when VM_GetLRU, VM_SetLRU, VM_GetLFU, or VM_SetLFU is called with a NULL key
- **fixed** — Reject zipmap payloads whose length fields overflow, which could cause out-of-bounds access on 32-bit platforms via RESTORE
- **fixed** — Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a later server crash
- **fixed** — Fix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit, such as Alpine 3.23
- **fixed** — Fix use of uninitialized memory when registering Lua functions with FUNCTION LOAD
- **fixed** — Fix listpack corruption and server crash when XTRIM marks the last entry in a stream listpack node as deleted
- **fixed** — Fix COMMAND INFO returning the subcommands field as a RESP3 Set instead of an Array for commands without subcommands
- **fixed** — Reject control characters in SENTINEL SET values and escape them on config rewrite to prevent config-file injection
- **fixed** — Reject control characters and unsafe delimiters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf injection
- **fixed** — Fix lua-enable-insecure-api having no effect when enabled at startup via the config file or command line

Valkey 7.2.14  -  Released Tue 21 July 2026
-------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
* CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

###### Bug Fixes
* Strictly check CRLF when parsing requests and reject malformed input as a protocol error instead of misparsing it by @enjoy-binbin (#2872)
* Fix a memory leak in `ZDIFF` and `ZDIFFSTORE` when the result set becomes empty during computation by @sarthakaggarwal97 (#3342)
* Fix a double free when loading a stream consumer group from a corrupted RDB or RESTORE payload by @enjoy-binbin (#3498)
* Fix a potential crash from a NULL pointer dereference when updating the TLS pending-data flag by @zuiderkwast (#3641)
* Fix a Lua VM crash when loading functions after `FUNCTION FLUSH ASYNC` and ensure flushed scripts' memory is released by @enjoy-binbin (#1826)
* Fix a use-after-free when a module unregisters and re-registers a cluster message receiver by @eifrah-aws (#3846)
* Fix a file descriptor leak when a blocking connection attempt times out, e.g. during `MIGRATE` to an unreachable host by @madolson (#3541)
* Fix a crash in the module API when `VM_GetLRU`, `VM_SetLRU`, `VM_GetLFU`, or `VM_SetLFU` is called with a NULL key by @yaronsananes (#3610)
* Fix invalid memory access when loading a malformed zipmap payload via `RESTORE` (CVE-2026-25243) by @ranshid (#3619)
* Reject zipmap payloads whose length fields overflow, which could cause out-of-bounds access on 32-bit platforms via `RESTORE` by @madolson (#3920)
* Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/`RESTORE` load, preventing a later server crash by @madolson (#3921)
* Fix a startup crash when generating `INFO` output on 32-bit systems where `time_t` is 64-bit, such as Alpine 3.23 by @chenshi5012 (#3787)
* Fix use of uninitialized memory when registering Lua functions with `FUNCTION LOAD` by @enjoy-binbin (#2750)
* Fix listpack corruption and server crash when `XTRIM` marks the last entry in a stream listpack node as deleted by @smkher (#3591)
* Fix `COMMAND INFO` returning the subcommands field as a RESP3 Set instead of an Array for commands without subcommands by @rickrams (#3939)
* Reject control characters in `SENTINEL SET` values and escape them on config rewrite to prevent config-file injection by @eifrah-aws (#3847)
* Reject control characters and unsafe delimiters in cluster AUX fields and `cluster-announce-ip` to prevent nodes.conf injection by @eifrah-aws (#3848)
* Fix `lua-enable-insecure-api` having no effect when enabled at startup via the config file or command line by @enjoy-binbin (#3548)
* Log the real error (e.g. `Connection reset by peer`) instead of the misleading `Success` on replication sync I/O errors by @abmathur-ie (#3580)
* Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @pkhartsk (#3843)
* Fix `valkey-cli --cluster del-node` failing with `No such node ID` when removing unreachable or failed nodes by @yang-z-o (#3209)
* Fix `valkey-cli --cluster fix` assigning all uncovered slots to the same primary instead of spreading them randomly by @abmathur-ie (#3586)

**Full Changelog**: https://github.com/valkey-io/valkey/compare/7.2.13...7.2.14

### 8.1.8

- Date: 2026-06-02
- Version: 8.1.8
- Original notes: https://github.com/valkey-io/valkey/releases/tag/8.1.8
- Permalink: https://whatsnew.fyi/product/valkey/releases/8.1.8

- **fixed** — Fix ZDIFF algorithm 2 memory leak on early exit
- **fixed** — Strictly check CRLF when parsing querybuf
- **fixed** — Fix incorrect memory overhead calculation for watched keys
- **fixed** — Fix valkey-cli --cluster del-node for unreachable nodes
- **fixed** — Fix race condition during async client freeing with IO threading enabled
- **fixed** — Fix double free in stream consumer PEL loading with corrupt RDB data
- **fixed** — Fix server crash when RDMA benchmark clients disconnect
- **fixed** — Fix misleading log "I/O error reading bulk count from PRIMARY: Success"
- **fixed** — Handle NULL pointer in streamTrim listpack delta calculation
- **fixed** — Fix Deferred Reply Placeholders in Active Deferred Buffers
- **fixed** — Add NULL check in updateSSLPendingFlag
- **fixed** — Fix heap-use-after-free in ACL LOAD when client free is deferred
- **security** — Redact customer information when hide_user_data_from_log is true in rdb.c, networking.c, debug.c and t_hash
- **fixed** — Fix use-after-free in VM_RegisterClusterMessageReceiver
- **security** — Harden SENTINEL commands and config rewrite against control-character injection
- **fixed** — Fix CLUSTER SLOTS crash when called from module timer callback

Upgrade urgency HIGH: There is a critical bug that may affect a subset of users.

Bug fixes
=========
* Fix ZDIFF algorithm 2 memory leak on early exit (#3342)
* Strictly check CRLF when parsing querybuf (#2872)
* Fix incorrect memory overhead calculation for watched keys (#3359)
* Fix `valkey-cli --cluster del-node` for unreachable nodes (#3209)
* Fix race condition during async client freeing with IO threading enabled (#3458)
* Fix double free in stream consumer PEL loading with corrupt RDB data (#3498)
* Fixes server crash when RDMA benchmark clients disconnect (#3448)
* Fix misleading log "I/O error reading bulk count from PRIMARY: Success" (#3580)
* Handle NULL pointer in streamTrim listpack delta calculation (#3591)
* Fix Deferred Reply Placeholders in Active Deferred Buffers (#3578)
* Add NULL check in updateSSLPendingFlag (#3641)
* Fix heap-use-after-free in ACL LOAD when client free is deferred (#3800)
* Redacting customer information when hide_user_data_from_log is true in rdb.c, networking.c, debug.c and t_hash  (#3872)
* Fix use-after-free in VM_RegisterClusterMessageReceiver (#3846)
* Harden SENTINEL commands and config rewrite against control-character injection (#3847)
* Fix CLUSTER SLOTS crash when called from module timer callback (#2915)

**Full Changelog**: https://github.com/valkey-io/valkey/compare/8.1.7...8.1.8

### 9.1.0

- Date: 2026-05-19
- Version: 9.1.0
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.1.0
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.1.0

- **security** — Fix use-after-free in unblock client flow (CVE-2026-23479)
- **security** — Fix invalid memory access in RESTORE command (CVE-2026-25243)
- **security** — Fix use-after-free when full sync occurs during a yielding Lua/function execution (CVE-2026-23631)
- **added** — Add cluster bus network traffic usage metric in bytes
- **changed** — Reduce latency spikes during rehashing via incremental page release
- **fixed** — Set errno on EOF in syncRead and propagate to conn->last
- **fixed** — Fix GEOSEARCH BYPOLYGON leak on invalid COUNT
- **fixed** — Handle NULL pointer in streamTrim listpack delta calculation
- **fixed** — Fix server crash when RDMA benchmark clients disconnect
- **fixed** — Fix memory leak in valkey-benchmark

Upgrade urgency LOW: This is the first stable release of Valkey 9.1.

###### Security fixes

* (CVE-2026-23479) Use-After-Free in unblock client flow
* (CVE-2026-25243) Invalid Memory Access in RESTORE command
* (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

###### New Features and enhanced behavior
* Add cluster bus network traffic usage metric in bytes by @hpatro (#3396)
* Reduce latency spikes during rehashing via incremental page release by @chzhoo (#3481)

###### Bug Fixes
* Fix(syncio): Set errno on EOF in syncRead and propagate to conn->last by @abmathur-ie (#3580)
* Fix GEOSEARCH BYPOLYGON leak on invalid COUNT by @bandalgomsu (#3568)
* Handle NULL pointer in streamTrim listpack delta calculation by @smkher (#3591)
* Fixes server crash when RDMA benchmark clients disconnect by @quanyeyang (#3448)
* Fix the memory leak in valkey-benchmark by @nmvk (#3643)

See also the release notes for 9.1.0-rc1 and 9.1.0-rc2.

### 8.0.9

- Date: 2026-05-06
- Version: 8.0.9
- Original notes: https://github.com/valkey-io/valkey/releases/tag/8.0.9
- Permalink: https://whatsnew.fyi/product/valkey/releases/8.0.9

- **security** — Fix use-after-free vulnerability in unblock client flow (CVE-2026-23479)
- **security** — Fix invalid memory access vulnerability in RESTORE command (CVE-2026-25243)
- **security** — Fix use-after-free vulnerability when full sync occurs during a yielding Lua/function execution (CVE-2026-23631)

Upgrade urgency SECURITY: This release supersedes 8.0.8 (revoked) and includes
security fixes we recommend you apply as soon as possible.

###### Security fixes

* (CVE-2026-23479) Use-After-Free in unblock client flow
* (CVE-2026-25243) Invalid Memory Access in RESTORE command
* (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

### 8.1.7

- Date: 2026-05-06
- Version: 8.1.7
- Original notes: https://github.com/valkey-io/valkey/releases/tag/8.1.7
- Permalink: https://whatsnew.fyi/product/valkey/releases/8.1.7

- **security** — Fixed use-after-free in unblock client flow (CVE-2026-23479)
- **security** — Fixed invalid memory access in RESTORE command (CVE-2026-25243)
- **security** — Fixed use-after-free when full sync occurs during a yielding Lua/function execution (CVE-2026-23631)

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

###### Security fixes

* (CVE-2026-23479) Use-After-Free in unblock client flow
* (CVE-2026-25243) Invalid Memory Access in RESTORE command
* (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

### 9.0.4

- Date: 2026-05-06
- Version: 9.0.4
- Original notes: https://github.com/valkey-io/valkey/releases/tag/9.0.4
- Permalink: https://whatsnew.fyi/product/valkey/releases/9.0.4

- **security** — Fix use-after-free in unblock client flow (CVE-2026-23479)
- **security** — Fix invalid memory access in RESTORE command (CVE-2026-25243)
- **security** — Fix use-after-free when full sync occurs during a yielding Lua/function execution (CVE-2026-23631)

Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.

###### Security fixes

* (CVE-2026-23479) Use-After-Free in unblock client flow
* (CVE-2026-25243) Invalid Memory Access in RESTORE command
* (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution