# Valkey 9.1.3 patches heap buffer overflow in cluster Pub/Sub, 20+ bugs

> **Key takeaway:** Valkey 9.1.3 fixes a critical heap buffer overflow in cluster Pub/Sub message construction that could enable remote code execution, alongside more than 20 stability and correctness bugs affecting replication, ACL parsing, and cluster operations.

**Published:** 2026-10-26T23:21:45+00:00 
**Source:** Valkey In-Memory Datastore 
**Category:** databases-storage 
**Canonical URL:** https://fosswire.org/news/valkey-913-patches-heap-buffer-overflow-in-cluster-pubsub-20.html 

## Summary
Valkey 9.1.3 arrived on October 26, 2026, as a security-driven patch release for the open-source Redis fork. The most urgent fix addresses GHSA-f4q9-j22m-xqq9, a heap buffer overflow in cluster-mode Pub/Sub message construction that allows authenticated clients to potentially execute arbitrary code by publishing oversized messages. Beyond this security vulnerability, the release resolves over twenty distinct bugs spanning stream commands, sorted set operations, hash expiration, cluster failover, module APIs, and replication consistency.

Administrators running Valkey in cluster mode or with consumer groups should prioritize this upgrade. The bug fixes correct failures in WATCH invalidation for stream commands, prevent crashes during ACL file loading and module timer callbacks, fix replica divergence on hash field expiration, and resolve cluster configuration corruption on SMB filesystems like Azure Files. Several fixes also restore compatibility behaviors with Valkey 9.0 to prevent replication and AOF replay failures during version upgrades.

## Critical fixes in Valkey 9.1.3
- **Security (GHSA-f4q9-j22m-xqq9):** A heap buffer overflow in cluster Pub/Sub message construction allowed authenticated clients to potentially achieve arbitrary code execution by publishing an oversized message; the fix bounds the message construction path.
- **Stream command correctness:** Commands that mutate consumer-group or PEL state (XGROUP, XSETID, XREADGROUP, XACK, XCLAIM, XAUTOCLAIM) now properly trigger WATCH and client-side tracking invalidation, restoring expected transactional semantics.
- **Replication and expiration consistency:** HDEL, HGETDEL, HPERSIST, and HEXPIRE no longer propagate fields they internally treat as expired, eliminating a source of replica and AOF-reload divergence; COPY of a hash now includes expired-but-unreaped fields to ensure replica synchronization.
- **Cluster stability:** The release fixes atomic slot migration to replicate evictions on the import target (preventing unbounded replica memory growth past maxmemory) and corrects migration with cluster-databases > 1 to avoid applying snapshot writes to the wrong target database.
- **Platform and operational fixes:** The event loop no longer busy-spins on VMs with non-TSC kernel clocksources; valkey-check-aof recognizes RDB base files with the VALKEY signature; cluster config saving uses a separate nodes.conf.lock file to avoid truncation and SMB filesystem failures; and error text is redacted from logs when hide-user-data-from-log is enabled.

## Why it matters
For Linux distributions and cloud operators shipping Valkey as a Redis replacement, this release closes a remotely exploitable security hole in cluster deployments and eliminates multiple classes of data inconsistency that could silently corrupt replicas or AOF recovery. The fixes for SMB filesystems and VM clocksource behavior directly improve reliability on common cloud and containerized infrastructure, while the restored 9.0 compatibility for hexadecimal float scores and listpack encoding reduces upgrade friction for production fleets.