Back to all use cases

CVE PatchingHealthcare / Benefits

Patching the version you validated, not the version upstream wants you on

Benefits Administration Provider

A regulated provider could not move its on-premises Valkey 7.2 clusters for another year. AceMQ assessed each security advisory against its configuration and backported the fixes through OSSeva.

Overview

A benefits administrator ran Valkey 7.2 behind its member portal and claims pipeline, on virtual machines in two data centres. Every application release went through a long validation cycle, and a move to Valkey 8 was scheduled for the following year.

Challenge

Security advisories kept arriving for a version the team could not upgrade in time, and every one needed an answer for the compliance team: does this affect us, and when is it fixed. Upgrading early meant revalidating client libraries and failover behaviour in the middle of an audit cycle.

Environment

Valkey 7.2 with Sentinel on RHEL virtual machines, two data centres, TLS between clients and servers, ACLs per application, Java clients on a pinned library version.

Approach

AceMQ engineers reviewed each advisory against the cluster's real configuration: the commands and scripting each ACL user could reach, whether the affected feature was enabled, and what a network attacker could actually do. Fixes for the advisories that did apply were backported to the 7.2 line through OSSeva, tested in staging with the production failover tests, and rolled out replica first.

Solution

  1. Triaged each advisory against ACL users, enabled features and network exposure, with a written exposure note per advisory
  2. Backported the fixes that applied to the 7.2 line through OSSeva and built them for the customer's operating system
  3. Ran the production failover and client test suite against each patched build in staging
  4. Rolled out replica first under the customer's existing change process, with a rehearsed rollback
  5. Applied interim mitigations, such as tighter ACLs on scripting, while a build was being tested
  6. Built the Valkey 8 upgrade plan alongside, with client library checks, so the move could be scheduled instead of forced

Outcome

Each advisory had a written answer within the compliance team's review window, and the patched builds went in through normal change control. The Valkey 8 upgrade stayed on its own schedule rather than being pulled forward by a security notice.

Technologies

ValkeyLinuxRedis Sentinel
  • Remediation

    Redis to Valkey Migration Under Memory Pressure

    Digital Collaboration PlatformSoftware

    A production Redis cluster was crashing under memory growth traced to its full-text index rather than to the workload. AceMQ diagnosed the leak, stabilized the cluster, and mapped the Valkey migration path.

    ValkeyRedisKubernetes
    Read case study: Redis to Valkey Migration Under Memory Pressure
  • Assessment

    Redis Persistence and Durability Assessment

    Public Sector AgencyGovernment

    Assessment of persistence configuration, replication topology, and failover behavior against the durability the workloads actually require.

    RedisRedis SentinelLinuxPrometheus
    Read case study: Redis Persistence and Durability Assessment
  • Consulting

    MariaDB 10.6 to 11.8 Upgrade Planning on Galera

    Healthcare Benefits AdministratorHealthcare

    Planning and rehearsing a rolling upgrade from MariaDB 10.6 to 11.8 on a Galera cluster, around the optimizer, TLS and change buffer differences.

    MariaDBGalera ClusterTerraformLinux
    Read case study: MariaDB 10.6 to 11.8 Upgrade Planning on Galera
  • Support

    Unblocking Producers on an ActiveMQ Classic Broker Pair

    Regional Payments ProcessorFinancial Services

    Four live sessions to find why every producer on an ActiveMQ Classic 5.16 pair stalled when one settlement consumer slowed, and to give each destination its own memory limit.

    ActiveMQSpring FrameworkJavaLinux
    Read case study: Unblocking Producers on an ActiveMQ Classic Broker Pair

Related Reading

Have a Valkey Challenge Like This?

AceMQ's senior Valkey engineers have handled this exact type of engagement before. Whether you need architectural guidance, hands-on remediation, or an ongoing managed partnership, we're ready to help.