# Valkey 7.2.15 fixes heap buffer overflow, ACL bypass, and 20 crash bugs

> **Key takeaway:** Valkey 7.2.15 is a security-critical patch release addressing a heap buffer overflow in cluster Pub/Sub, an ACL bypass in GEORADIUS, and numerous crash-inducing bugs in AOF replay, RDB loading, TLS connections, and module APIs.

**Published:** 2026-10-26T21:43:02+00:00 
**Source:** Valkey In-Memory Datastore 
**Category:** databases-storage 
**Canonical URL:** https://fosswire.org/news/valkey-7215-fixes-heap-buffer-overflow-acl-bypass-and-20-cra.html 

## Summary
Valkey 7.2.15 shipped on October 26, 2026 with a SECURITY upgrade urgency rating, patching a heap buffer overflow in cluster Pub/Sub message construction that could enable remote code execution by authenticated clients. The release also fixes an ACL bypass where duplicate STORE/STOREDIST options allowed GEORADIUS to write or delete keys outside permitted patterns, plus resolves silent data loss during AOF replay when the default user is disabled.

Beyond the two security issues, the update hardens RDB and RESTORE payload validation for listpacks and streams, fixes double-free and use-after-free crashes in module timers and cluster messaging, corrects a TLS stack overflow on large write retries, and resolves operational bugs including truncated cluster config saves on SMB filesystems, inflated replica memory accounting, and valkey-benchmark spinning on would-block writes.

## Security and stability fixes in Valkey 7.2.15
- **Cluster Pub/Sub security (GHSA-f4q9-j22m-xqq9):** A heap buffer overflow in cluster Pub/Sub message construction allowed authenticated clients to crash the server or potentially execute arbitrary code by publishing oversized messages; this is now bounds-checked.
- **ACL bypass in GEORADIUS:** Duplicate STORE/STOREDIST options could bypass key-pattern restrictions, permitting writes or deletions outside the user's permitted ACL patterns; the parser now rejects duplicate options.
- **AOF replay and data loss:** ACL checks are no longer performed during AOF loading, preventing silent discard of replayed commands when the default user is disabled; previously this caused unrecoverable data loss after restart.
- **RDB/RESTORE hardening:** Listpacks are now always validated on RDB load and RESTORE, with sanitize-dump-payload becoming a no-op; stream payloads with mismatched live/deleted counts are rejected; and RESTORE payloads with overflowing string lengths are now rejected as bad data rather than causing server aborts.
- **Module and cluster messaging stability:** Fixes address a use-after-free when cluster messages arrive after module unload, out-of-bounds access for cluster module message type 255 (now valid and dispatchable), and a double-free when module timer callbacks stop their own timer via ValkeyModule_StopTimer.

## Why it matters
Valkey's emergence as the BSD-licensed Redis fork makes each security release significant for cloud providers and distributions that have migrated from Redis to avoid the SSPL license change. The cluster Pub/Sub RCE and GEORADIUS ACL bypass are exploitable by authenticated users in multi-tenant deployments, making this a mandatory upgrade for managed database services and containerized workloads. The AOF replay fix resolves a particularly insidious failure mode where disabling the default user—a common hardening step—caused silent data loss on restart, which will restore operational confidence for security-conscious administrators.