# Valkey 8.1.10

- Product: Valkey (https://whatsnew.fyi/product/valkey)
- Vendor: Linux Foundation
- Date: 2026-08-31
- Version: 8.1.10
- Original notes: https://github.com/valkey-io/valkey/releases/tag/8.1.10
- Permalink: https://whatsnew.fyi/product/valkey/releases/8.1.10

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL on servers built with USE_RDMA and configured with an RDMA listener
- **fixed** — Fix a double free when a module timer callback stops its own timer with ValkeyModule_StopTimer
- **fixed** — RESET now clears the CLIENT IMPORT-SOURCE flag so reused pooled connections stop reading logically expired keys
- **fixed** — Fix AOF recovery of a truncated MULTI/EXEC block that could cause new writes to be lost after a subsequent restart
- **fixed** — Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands escaped key write permission checks
- **fixed** — Fix a use-after-free crash when a cluster message of a module-registered type arrives after the module is unloaded
- **fixed** — Fix out-of-bounds access when registering or receiving cluster module messages of type 255
- **fixed** — Skip ACL permission checks when replaying the AOF, preventing silent data loss when users are restricted or disabled
- **fixed** — Fix a client memory accounting leak that inflated mem_clients_normal on replicas after disconnecting from the primary
- **fixed** — Always validate listpacks on RDB load and RESTORE to prevent deferred crashes
- **deprecated** — sanitize-dump-payload and the related ACL flags are now deprecated no-ops
- **fixed** — Fix a stack overflow crash when retrying large TLS writes after an OpenSSL write error
- **fixed** — Validate PUBLISH and MODULE cluster bus packet lengths, preventing a crash from forged packets with oversized payload lengths
- **fixed** — Reject crafted stream RESTORE/RDB payloads with inconsistent lengths or negative field counts that could crash the server
- **fixed** — Fix a use-after-free crash when serving multiple clients blocked on the same key if one is freed during processing
- **fixed** — Fix CLUSTER SLOT-STATS ORDERBY sorting when slot statistics differ by more than 2^31

Valkey 8.1.10  -  Released Mon 31 August 2026
---------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

###### Security Fixes
* GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)

###### Bug Fixes
* Fix a double free when a module timer callback stops its own timer with `ValkeyModule_StopTimer` by @quanyeyang (#4211)
* RESET now clears the `CLIENT IMPORT-SOURCE` flag so reused pooled connections stop reading logically expired keys by @tjade273 (#3973)
* Fix AOF recovery of a truncated MULTI/EXEC block that could cause new writes to be lost after a subsequent restart by @chzhoo (#4342)
* Fix an ACL bypass where duplicate STORE/STOREDIST options in GEORADIUS commands escaped key write permission checks by @tjade273 (#3971)
* Fix a use-after-free crash when a cluster message of a module-registered type arrives after the module is unloaded by @enjoy-binbin (#4360)
* Fix out-of-bounds access when registering or receiving cluster module messages of type 255, which is now fully supported by @enjoy-binbin (#4410)
* Skip ACL permission checks when replaying the AOF, preventing silent data loss when users are restricted or disabled by @lukepalmer (#3984)
* Fix a client memory accounting leak that inflated `mem_clients_normal` on replicas after disconnecting from the primary by @enjoy-binbin (#4395)
* Always validate listpacks on RDB load and RESTORE to prevent deferred crashes; `sanitize-dump-payload` and the related ACL flags are now deprecated no-ops by @jjuleslasarte (#3721)
* Fix a stack overflow crash when retrying large TLS writes after an OpenSSL write error by @murphyjacob4 (#4307)
* Validate PUBLISH and MODULE cluster bus packet lengths, preventing a crash from forged packets with oversized payload lengths by @tjade273 (#3972)
* Reject crafted stream RESTORE/RDB payloads with inconsistent lengths or negative field counts that could crash the server by @madolson (#3922)
* Fix a use-after-free crash when serving multiple clients blocked on the same key if one is freed during processing by @quanyeyang (#4212)
* Fix CLUSTER SLOT-STATS ORDERBY sorting when slot statistics differ by more than 2^31 by @jzy1688 (#4459)

**Full Changelog**: https://github.com/valkey-io/valkey/compare/8.1.9...8.1.10