Valkey
Table of Contents
Notes on my contributions to Valkey (a Redis fork): bug fixes, Raft/RDMA features, and related CVE analysis.
Bug fixes #
- Why multithreading causes issues (summary)
- Multithread RDMA crash
- Multithread RDMA crash (lock-free IO model)
- valkey-benchmark RDMA lost wakeup
- Valkey Over RDMA: server UAF in tests
- 32-bit build header include order
- Multithread RDB crash
- RESP3 push frame torn apart (pubsub ≥ 16KiB)
- UAF with multiple BLPOP
- Sync re-entrancy / UAF
- Client-side caching reverse-index leak after disconnect
Features #
- Raft Cluster Pre-Vote
- Raft Cluster non-voting members
- Raft Cluster valkey-cli tooling
- Raft-based cluster bus (Cluster V2)
- Valkey Over RDMA: multithread tests
- RDMA library runtime dynamic loading
Security #
- CVE-2026-27623: pre-auth DoS via malformed RESP
- CVE-2026-25243: RESTORE invalid memory access / RCE
- RDB_OPCODE_SLOT_IMPORT short job_name OOB read
RDMA background #
2026
RESP3 push frame torn apart when a pubsub message >= 16384 bytes is delivered to the publishing connection (9.0 regression)
Preventing UAF from synchronous reentrancy
UAF with multiple BLPOP waiters
RDB_OPCODE_SLOT_IMPORT short job_name causes server-side heap out-of-bounds read during startup RDB loading
Client-side caching: server reverse-index leak after disconnect (unbounded growth)
Valkey Over RDMA: server UAF crash in tests
Multithread RDMA crash (lock-free IO queue model)
Valkey Over RDMA Internals