Redis and Valkey Each Ship Security Releases for a Cluster PUBLISH Heap Buffer Overflow on Messages Over 4 GB; Valkey Scores Its Advisory 8.8

Overview

Redis and Valkey each published security releases on October 26, 2026 that fix a heap buffer overflow in how a cluster node handles a very large PUBLISH message. The Redis release notes carry no further detail; the Valkey advisory explains the mechanism.

What the Redis releases say

Redis released 8.10.3, 8.8.4, 8.6.8, 8.4.8, 8.2.11, 7.4.12 and 7.2.17. That is seven releases across seven branches, by the Herald’s own count of the release pages listed here. Each page opens with “Update urgency: SECURITY: There is a security fix in the release.” and lists a single security fix: “Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode”.

None of the seven release notes gives a CVE or advisory identifier, a severity score, or a description of what an attacker would need. The previous Redis security releases, covered by the Herald earlier this month, were published on September 17.

What the Valkey advisory says

Valkey published releases 9.1.3, 9.0.7, 8.1.11, 8.0.12 and 7.2.15, each dated Monday, October 26, 2026 in its notes. Each says that the “GHSA-f4q9-j22m-xqq9” fix addresses “a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message”. The 7.2.15 notes add that the client could “crash the server”.

The advisory is titled “Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow”. It is rated high severity with a CVSS 3.1 score of 8.8 and shows no CVE identifier. According to the advisory, the cluster code computes the message length as a size_t but passes it to a function that takes a uint32_t, so when the channel and message together exceed UINT32_MAX, “the length is silently truncated” and a buffer much smaller than the message is allocated.

The advisory lists these conditions and limits:

• It affects Valkey 7.2, 8.0, 8.1, 9.0, 9.1 and 9.2 in cluster mode; “Servers that do not have cluster mode enabled are not affected.”
• Building such a message “requires more than 4 GiB of memory”. With the default proto-max-bulk-len of 512 MB, the advisory says, “a client cannot send arguments that large directly, but a script can construct them on the server.”
• After the fix, “PUBLISH and SPUBLISH now reply with an error, and the message is neither published locally nor propagated.”

As mitigation, the advisory suggests using Valkey ACLs to restrict scripting commands (EVAL, EVALSHA, EVAL_RO, EVALSHA_RO, FCALL, FCALL_RO and FUNCTION) if an application does not use them, and not raising proto-max-bulk-len above its default. It credits the report to “Nenad Stojanovski working with Trend Micro Zero Day Initiative (ZDI-CAN-28318)”. The advisory lists 9.2.0-rc2 among the patched versions alongside the five stable releases above.

What We Don’t Know

• Neither project’s cited pages say the two fixes are the same defect or were coordinated. The Redis note and the Valkey advisory both describe a heap buffer overflow tied to cluster PUBLISH/SPUBLISH messages above 4 GB.
• The Redis notes do not state a severity, whether code execution is possible, or which Redis versions are affected beyond the releases listed.
• The Redis release notes assign no CVE, and the Valkey advisory shows none.