Valkey 8.1.4
Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.
Security fixes
- (CVE-2025-49844) A Lua script may lead to remote code execution
- (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
- (CVE-2025-46818) A Lua script can be executed in the context of another user
- (CVE-2025-46819) LUA out-of-bound read
Bug fixes
- Fix accounting for dual channel RDB bytes in replication stats (#2614)
- Fix EVAL to report unknown error when empty error table is provided (#2229)
- Fix use-after-free when active expiration triggers hashtable to shrink (#2257)
- Fix MEMORY USAGE to account for embedded keys (#2290)
- Fix memory leak when shrinking a hashtable without entries (#2288)
- Prevent potential assertion in active defrag handling large allocations (#2353)
- Prevent bad memory access when NOTOUCH client gets unblocked (#2347)
- Converge divergent shard-id persisted in nodes.conf to primary's shard id (#2174)
- Fix client tracking memory overhead calculation (#2360)
- Fix RDB load per slot memory pre-allocation when loading from RDB snapshot (#2466)
- Don't use AVX2 instructions if the CPU doesn't support it (#2571)
- Fix bug where active defrag may be unable to defrag sparsely filled pages (#2656)
Full Changelog: 8.1.3...8.1.4