Valkey 9.0
Valkey 9.0
Third-party support for the Valkey 9.0: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance — independent of the vendor contract.
24/7 engineers own your Valkey 9.0 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- valkey
- release
- 9.0
- product Label
- Valkey
- release Label
- 9.0
- codename
- lts
- latest Version
- 9.0.5
- release Date
- 2025-10-21
- maintained
- true
- source Url
- https://endoflife.date/valkey
Lifecycle Dates
- End of Service Life
- Oct 21, 2028
- Last OEM Support
- Oct 21, 2028
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Valkey 9.0 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Valkey 9.0?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Valkey 9.0 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Valkey 9.0 Support: Frequently Asked Questions
Is the Valkey 9.0 still supported?
Yes. The Valkey 9.0 is currently supported by Valkey, and third-party support is available as an alternative — issue management, vulnerability remediation, and compliance help independent of the vendor contract.
When is the Valkey 9.0 end of service life (EOSL) date?
Valkey lists the end of service life for the Valkey 9.0 as Oct 21, 2028.
Can I keep using the Valkey 9.0 after its EOSL date?
Yes. EOSL means Valkey stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Valkey 9.0 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Valkey 9.0
3 published CVEs affect the Valkey 9.0, including 3 rated critical or high severity. Our 24/7 engineers help you assess exposure, prioritize fixes and apply available patches.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-67733 | HIGH | 8.5 | Feb 23, 2026 | Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. |
| CVE-2026-27623 | HIGH | 7.5 | Feb 23, 2026 | Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Ver |
| CVE-2026-21863 | HIGH | 7.5 | Feb 23, 2026 | Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As |