Valkey · week of 26 Oct 2026

Valkey security note

Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.

What changed

GHSA-f4q9-j22m-xqq9 — Open the advisory
Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow
Affected <= 9.2.0-rc1

What we still do not know

ZDI-26-833 — Open the advisory
ZDI-26-833: Valkey clusterCreatePublishMsgBlock Numeric Truncation Error Remote Code Execution Vulnerability
No version range is stored, so an installed version cannot be checked.

Share this note

Valkey security note, week of 26 Oct 2026: 1 record has a version a customer can check, and 1 still does not. https://zerodayfindings.com/technologies/valkey/notes/2026-W44