Valkey 8.1.6 - Released Mon 23 February 2026
Upgrade urgency SECURITY: This release includes security fixes we recommend you
apply as soon as possible.
Security fixes
- (CVE-2026-21863) Remote DoS with malformed Valkey Cluster bus message
- (CVE-2025-67733) RESP Protocol Injection via Lua error_reply
Bug fixes
- Restrict ttl from being negative and avoid crash in import-mode (#2944)
- Fix chained replica crash when doing dual channel replication (#2983)
- Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)
- Fix crashing while MODULE UNLOAD when ACL rules reference a module command or subcommand (#3160)
- Fix server assert on ACL LOAD and resetchannels (#3182)
- Fix bug causing no response flush sometimes when IO threads are busy (#3205)