valkey-io/valkey 7.2.15
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Valkey shipped security patch releases on 26 October for the 7.2, 8.0, 8.1 and 9.1 lines (7.2.15, 8.0.12, 8.1.11, 9.1.3). All fix GHSA-f4q9-j22m-xqq9, a heap buffer overflow in cluster Pub/Sub message construction that an authenticated client could trigger with an oversized message, with possible code execution. The 7.2 notes also list a GEORADIUS ACL bypass, AOF and RESTORE validation fixes, and a nodes.conf locking change. Clusters using Pub/Sub should upgrade; the advisory's severity was not independently checked here.