Valkey
Table of Contents
Notes on my contributions to Valkey (a Redis fork): bug fixes, Raft/RDMA features, and related CVE analysis.
Bug fixes #
- Why multithreading causes issues (summary)
- Multithread RDMA crash
- Multithread RDMA crash (lock-free IO model)
- valkey-benchmark RDMA lost wakeup
- Valkey Over RDMA: server UAF in tests
- 32-bit build header include order
- Multithread RDB crash
- RESP3 push frame torn apart (pubsub ≥ 16KiB)
- UAF with multiple BLPOP
- Sync re-entrancy / UAF
- Client-side caching reverse-index leak after disconnect
Features #
- Raft Cluster Pre-Vote
- Raft Cluster non-voting members
- Raft Cluster valkey-cli tooling
- Raft-based cluster bus (Cluster V2)
- Valkey Over RDMA: multithread tests
- RDMA library runtime dynamic loading
Security #
- CVE-2026-27623: pre-auth DoS via malformed RESP
- CVE-2026-25243: RESTORE invalid memory access / RCE
- RDB_OPCODE_SLOT_IMPORT short job_name OOB read
RDMA background #
2026
Valkey Over RDMA: Multithread Tests (New Test Framework)
CVE-2026-25243 Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution
CVE-2026-27623 Pre-Authentication DOS from malformed RESP request
Multithread RDMA crash
Why multithreading causes issues (summary)
Multithread RDB crash