valkey

Valkey 8.0.10 - Released Tue 21 July 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes

• CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to crash the server using CLIENT KILL (#4234)
• CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers. Reported by @z0v3r1n and @lifip. (#4073)

Bug Fixes

• Strictly validate CRLF line endings when parsing the RESP protocol, rejecting malformed requests as protocol errors by @enjoy-binbin (#2872)
• Fix memory leak in ZDIFF/ZDIFFSTORE when the result set becomes empty before all input sets are processed by @sarthakaggarwal97 (#3342)
• Fix crash caused by a race between asynchronous client freeing and IO threads reading from the closing client by @deepakrn (#3458)
• Fix double free when loading corrupt stream RDB data containing duplicate consumer PEL entries by @enjoy-binbin (#3498)
• Fix stream corruption and crash when XTRIM marks the last entry of a listpack node as deleted by @smkher (#3591)
• Fix potential crash in TLS pending-data handling when the connection has no SSL object by @zuiderkwast (#3641)
• Fix use-after-free when ACL LOAD removes a user whose authenticated client's free is deferred by @ranshid (#3800)
• Fix use-after-free when a module unregisters the first-registered cluster message receiver for a message type by @eifrah-aws (#3846)
• Fix crash when loading functions after FUNCTION FLUSH ASYNC and make FUNCTION FLUSH actually release Lua VM memory by @enjoy-binbin (#1826)
• Fix file descriptor leak when a blocking connect times out, such as MIGRATE to an unreachable host by @madolson (#3541)
• Fix crash in module LRU/LFU API functions (GetLRU, SetLRU, GetLFU, SetLFU) when passed a NULL key by @yaronsananes (#3610)
• TLS synchronous I/O no longer leaves a blocking socket in non-blocking mode, preventing unexpected short reads by @xbasel (#1298)
• Fix crash when CLUSTER SLOTS is called without a real client connection, such as from a module timer callback by @bandalgomsu (#2915)
• Fix assertion crash in the IO thread job queue on ARM/aarch64 caused by memory store reordering by @jjuleslasarte (#3878)
• Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
• Reject NAN scores in listpack and ziplist encoded sorted sets on RDB load, preventing a later crash on skiplist conversion by @madolson (#3921)
• Fix crash on 32-bit systems where time_t is 64-bit (e.g. Alpine with time64) when generating INFO output by @chenshi5012 (#3787)
• COMMAND INFO in RESP3 now returns an empty Array instead of a Set for the subcommands field of commands without subcommands by @rickrams (#3939)
• Manual failover votes are no longer restricted by two times the node timeout, preventing manual failover timeouts by @enjoy-binbin (#1305)
• Automatic failover votes are no longer restricted by two times the node timeout, matching the manual failover change by @enjoy-binbin (#1356)
• SENTINEL SET now rejects values containing control characters and config rewrite escapes them, preventing config injection by @eifrah-aws (#3847)
• Reject control characters and delimiters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf injection by @eifrah-aws (#3848)
• Fix lua-enable-insecure-api yes not taking effect when set at startup via config file or command line by @enjoy-binbin (#3548)
• Log 'Connection reset by peer' instead of the misleading 'Success' when the connection to the primary closes during sync by @abmathur-ie (#3580)
• Redact key names and user data from additional server log messages when hide-user-data-from-log is enabled by @zackcam (#3872)
• Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @pkhartsk (#3843)
• valkey-cli --cluster del-node can now remove unreachable or failed nodes instead of failing with 'No such node ID' by @yang-z-o (#3209)
• Fix valkey-cli --cluster assigning all uncovered slots to the same primary instead of distributing them randomly by @abmathur-ie (#3586)

Full Changelog: https://github.com/valkey-io/valkey/compare/8.0.9...8.0.10