Valkey 8.1.11 patches heap buffer overflow in cluster Pub/Sub, 12 bug fixes

Valkey 8.1.11, released October 26, 2026, is a security-focused patch release for the open-source Redis fork that addresses one critical vulnerability and twelve bugs affecting data integrity, server stability, and operational correctness. The headline fix resolves GHSA-f4q9-j22m-xqq9, a heap buffer overflow in cluster-mode Pub/Sub message construction where an authenticated client could trigger arbitrary code execution by publishing an oversized message. Beyond the security fix, the release corrects stream commands that failed to invalidate WATCH and client-side tracking, eliminates server crashes during module writes under CLIENT PAUSE WRITE or CLUSTER FAILOVER, and patches multiple abort conditions in RESTORE, ACL loading, and sorted set operations.

The bug fixes span several subsystems: stream consumer-group state changes now properly trigger invalidation; module timer callbacks and thread-safe contexts are blocked from writes during paused states; RESTORE payloads with overflowing string lengths are rejected; ZINTER/ZINTERSTORE now handles NaN weighted scores consistently with ZUNION; and LSET on 64-bit builds returns proper out-of-range errors rather than silently corrupting data. Operational improvements include redaction of keys and values from server logs when hide-user-data-from-log is enabled, and a reworked cluster configuration locking mechanism that prevents truncated nodes.conf files and restores compatibility with SMB filesystems such as Azure Files.

Security and stability fixes in Valkey 8.1.11

• Cluster Pub/Sub security (GHSA-f4q9-j22m-xqq9): A heap buffer overflow in cluster-mode Pub/Sub message construction allowed authenticated clients to potentially execute arbitrary code by publishing oversized messages; the fix bounds the message construction buffer.
• Stream command invalidation: Commands mutating consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) now correctly trigger WATCH and client-side tracking invalidation, ensuring transactional and cache-coherence guarantees.
• Module write safety during pause: Module timer callbacks and thread-safe contexts attempting writes during CLIENT PAUSE WRITE or CLUSTER FAILOVER are now explicitly rejected, preventing server crashes from unsynchronized writes.
• RESTORE and allocation hardening: RESTORE payloads declaring string lengths that overflow allocation sizes are rejected as bad data, closing an abort vector; similarly, relative expire times in SET/GETEX/RESTORE and the module SetExpire API that would overflow into negative values are now rejected.
• Cluster config and logging robustness: Cluster configuration saving uses a separate nodes.conf.lock file, eliminating truncation, startup lock loss, and SMB filesystem failures; error reply text is redacted from logs when hide-user-data-from-log is enabled to prevent key/value leakage.

Why it matters

For Linux distributions and cloud operators running Valkey as a Redis replacement, this release closes a remotely exploitable code execution path in clustered deployments and eliminates several crash conditions that could cause outages or data corruption. The cluster configuration locking fix specifically benefits Azure Files and other SMB-backed deployments that were previously unable to save cluster state reliably, while the logging redaction aids compliance-sensitive environments.