Valkey 9.0.7 patches critical heap buffer overflow in cluster Pub/Sub

Valkey 9.0.7, released October 26, 2026, is a security-urgent patch for the open-source Redis fork, headlined by GHSA-f4q9-j22m-xqq9, a heap buffer overflow in cluster Pub/Sub message construction that could allow authenticated clients to execute arbitrary code via oversized messages. Beyond this critical fix, the release addresses 18 distinct bugs spanning stream command semantics, module API correctness, sorted set mathematics, hash expiration propagation, cluster migration integrity, and configuration persistence on network filesystems.

Administrators running Valkey in clustered configurations should prioritize this upgrade, as several fixes target replica divergence and data loss scenarios: atomic slot migration now properly replicates evictions and applies writes to the correct database index, while COPY and HDEL-family commands no longer drop expired fields in ways that desynchronize replicas from primaries. The release also hardens the server against malformed RESTORE payloads, ACL file parsing crashes, and memory exhaustion from malformed COMMAND GETKEYS invocations.

Security and correctness fixes in Valkey 9.0.7

• Cluster Pub/Sub security (GHSA-f4q9-j22m-xqq9): A heap buffer overflow in cluster-mode Pub/Sub message construction allowed authenticated clients to potentially achieve arbitrary code execution by publishing messages exceeding expected size boundaries; the fix bounds the message construction path.
• Stream command invalidation: Commands that mutate consumer-group or pending-entry-list state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) now properly trigger WATCH and client-side tracking invalidation, closing a cache-coherence gap for applications relying on optimistic locking.
• Sorted set mathematics: ZINTER and ZINTERSTORE previously returned input-order-dependent scores when a weighted term evaluated to 0 multiplied by infinity; NaN weighted scores now normalize to 0, aligning behavior with ZUNION and eliminating nondeterministic results.
• Cluster migration integrity: Two separate fixes ensure atomic slot migration replicates evictions on the import target (preventing replica memory bloat past maxmemory) and correctly routes writes to the intended database index when cluster-databases exceeds 1.
• Configuration and logging hardening: Cluster config saving now uses a separate nodes.conf.lock file, eliminating truncation, startup-lock loss, and SMB filesystem failures (including Azure Files); the hide-user-data-from-log setting now redacts command arguments from error text in server logs.

Why it matters

As a widely deployed Redis alternative backed by the Linux Foundation, Valkey's security posture directly affects cloud infrastructure, caching layers, and real-time messaging pipelines across Linux distributions and container platforms. The cluster-specific replication and migration fixes reduce operational risk for horizontally scaled deployments, while the module API and ACL parsing corrections improve stability for organizations extending Valkey with custom modules or centralized access control.