valkey
9.1.3A flexible distributed key-value database that is optimized for caching and other realtime workloads.
- Maintenance
- Active434 commits in 3 months · bus factor 1
- License
- BSD-3-ClausePermissive · OSI-approved
- Security
- 13 advisories10 high, 3 medium · Scorecard 6.1/10
- Supported versions
- 5 lines supportednewest 9.1 · oldest 7.2 until Apr 16, 2029
27.7k stars · 1.5k forks · 1k open issues · last release 19 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 13 most recent advisories published by the maintainers: 10 high, 3 medium. Check the patched version against the one you run.
- highGHSA-f4q9-j22m-xqq9Oct 26, 2026Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow
- Affected
- <= 9.2.0-rc1, <= 9.1.2, <= 9.0.6, <= 8.1.10, <= 8.0.11, <= 7.2.14
- Patched in
- 9.2.0-rc2, 9.1.3, 9.0.7, 8.1.11, 8.0.12, 7.2.15
- highGHSA-fq2f-crmw-q97rAug 31, 2026Unauthenticated use-after-free of the Lua interpreter state in Valkey (script debugger command cache)
- Affected
- <=9.1.1
- Patched in
- 9.1.2
- highGHSA-jcj7-v34w-v9vvAug 31, 2026Use-after-free in the RDMA pending-data handler when a client
- Affected
- <= 9.1.1, <= 9.0.5, <= 8.1.9, <= 8.0.10
- Patched in
- 9.1.2, 9.0.6, 8.1.10, 8.0.11
- highCVE-2026-63639Jul 22, 2026UAF in stream deserialization may lead to remote code execution
- Affected
- <= 9.1.0, <= 9.0.4, <= 8.1.8, <= 8.0.9, <= 7.2.13
- Patched in
- 9.1.1, 9.0.5, 8.1.9, 8.0.10, 7.2.14
- highCVE-2026-56684Jul 22, 2026UAF in Valkey with TLS may lead to remote code execution
- Affected
- <= 9.1.0, <= 9.0.4, <= 8.1.8, <= 8.0.9, <= 7.2.13
- Patched in
- 9.1.1, 9.0.5, 8.1.9, 8.0.10, 7.2.14
- highCVE-2026-27623Feb 23, 2026Pre-Authentication DOS from malformed RESP request
- Affected
- =>9.0.0, <= 9.0.2
- Patched in
- 9.0.3
- mediumCVE-2026-21863Feb 23, 2026Remote DoS with malformed Valkey Cluster bus message
- Affected
- <= 9.0.2
- Patched in
- 9.0.3, 8.1.6, 8.0.7, 7.2.12
- highCVE-2025-67733Feb 23, 2026RESP Protocol Injection via Lua error_reply
- Affected
- <= 9.0.1
- Patched in
- 9.0.2, 8.1.6, 8.0.7, 7.2.12
- highCVE-2025-49844Oct 3, 2025Lua Use-After-Free may lead to remote code execution
- Affected
- 7.2.10 and below, 8.0.5 and below, 8.1.3 and below
- Patched in
- 7.2.11 and above, 8.0.6 and above, 8.1.4 and above
- highCVE-2025-21605Apr 28, 2025DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client
- Affected
- >= 7.2
- Patched in
- 7.2.9, 8.0.3, 8.1.1
- mediumCVE-2024-31228Nov 11, 2024Denial-of-service due to unbounded pattern matching
- Affected
- <= 7.2.6, 8.0.0
- Patched in
- 7.2.7, 8.0.1
- mediumCVE-2024-31227Nov 11, 2024Denial-of-service due to malformed ACL selectors
- Affected
- <= 7.2.6, 8.0.0
- Patched in
- 7.2.7, 8.0.1
- highCVE-2024-31449Nov 11, 2024Lua library commands may lead to stack overflow and potential RCE
- Affected
- <= 7.2.6, 8.0.0
- Patched in
- 7.2.7, 8.0.1