valkey

v8.1.9 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 5d Caching

✓ No known CVEs patched

This release patches 2 known CVEs

Topics

cache database key-value key-value-store nosql redis

+2 more

valkey valkey-client

Affected surfaces

rce_ssrf crypto_tls

Summary

AI summary

Updates Bug Fixes, Security Fixes, and CVE-2026-56684 across a mixed release.

Full changelog

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

Fix clients being left on the wrong database after module keyspace notifications from commands like MOVE and COPY by @enjoy-binbin (#4024)
Fix an I/O thread job queue memory-ordering race that could trigger an assertion crash on ARM/aarch64 by @jjuleslasarte (#3878)
Reject zipmap RESTORE payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
Reject NAN scores when loading listpack/ziplist-encoded sorted sets, preventing a crash from crafted RESTORE payloads by @madolson (#3921)
Fix a startup crash when generating INFO output on 32-bit systems where time_t is 64-bit (e.g. Alpine time64) by @chenshi5012 (#3787)
Fix COMMAND INFO in RESP3 to reply with an empty Array instead of a Set for commands without subcommands by @rickrams (#3939)
Reject invalid characters in cluster AUX fields and cluster-announce-ip to prevent nodes.conf corruption and injection by @eifrah-aws (#3848)
Fix lua-enable-insecure-api having no effect when enabled at startup via config file or command line by @enjoy-binbin (#3548)
Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long installation paths by @pkhartsk (#3843)

Full Changelog: https://github.com/valkey-io/valkey/compare/8.1.8...8.1.9

CVE-2026-56684 — use-after-free in TLS connection handling enabling authenticated remote code execution
CVE-2026-63639 — reject corrupt stream RDB files with shared NACK to prevent remote code execution

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track valkey

Get notified when new releases ship.

About valkey

A flexible distributed key-value database that is optimized for caching and other realtime workloads.