-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 24 Oct 2026 10:19:26 -0500 Source: valkey Built-For-Profiles: derivative.ubuntu noudeb Architecture: source Version: 8.1.1+dfsg1-3+deb13u3 Distribution: trixie-security Urgency: medium Maintainer: Lucas Kanashiro <kanashiro@debian.org> Changed-By: Lena Voytek <lena@debian.org> Closes: 1144956 1144957 1146641 Changes: valkey (8.1.1+dfsg1-3+deb13u3) trixie-security; urgency=medium . * Fix CVE-2026-56684 (Closes: #1144956) Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. - d/p/CVE-2026-56684.patch * Fix CVE-2026-63639 (Closes: #1144957) Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. - d/p/CVE-2026-63639.patch * Fix CVE-2026-82631 and CVE-2026-82677 (Closes: #1146641) A server-side use-after-free can occur in handleClientsBlockedOnKey. - d/p/CVE-2026-82631.patch A server-side double free can occur in moduleTimerHandler. - d/p/CVE-2026-82677.patch * Fix CVE-2026-23479 Valkey's unblockClientOnKey function re-executes a blocked client's pending command and then accesses the client without checking whether it was freed during processing, causing a use-after-free. - d/p/CVE-2026-23479.patch * Fix CVE-2026-23631 Valkey frees the functions/scripting engine before loading the RDB during a replica full sync, which can happen while a Lua script is yielding via the long-command mechanism, causing a use-after-free when the script resumes. - d/p/CVE-2026-23631.patch * Fix CVE-2026-25243 Valkey's zipmapValidateIntegrity function accepts overlong length encodings that zipmapNext later interprets differently, allowing a crafted RESTORE payload to cause a heap buffer over-read during zipmap to listpack conversion. - d/p/CVE-2026-25243.patch Checksums-Sha1: 3fdb869674f775b590e8444354210dbb843ee8c4 2271 valkey_8.1.1+dfsg1-3+deb13u3.dsc 40f52feab50d74dc579abf6702429bbd080dce39 2726128 valkey_8.1.1+dfsg1.orig.tar.xz 0ea6d03241018dfdef03dd0588504f9b3d26226a 37428 valkey_8.1.1+dfsg1-3+deb13u3.debian.tar.xz 06132185cb9e8a10993ba3e6500083ecb568b1b2 8313 valkey_8.1.1+dfsg1-3+deb13u3_source.buildinfo Checksums-Sha256: 317246ffea280a14427d83f059a0696f1aef51247b30d7f1675f45849ea5d774 2271 valkey_8.1.1+dfsg1-3+deb13u3.dsc d9bbd82eecb82f359e649a0007ad3dc1b47cc15afa626348ca86b73c4ae2c7ee 2726128 valkey_8.1.1+dfsg1.orig.tar.xz d3c5f3bf8d880abd0aff543509d9226a8f2b64037cdfb165f597d45888bb0aea 37428 valkey_8.1.1+dfsg1-3+deb13u3.debian.tar.xz a5f255502c8f07732727bebc17ebed015b5bf365b016eb8769b1d6df29ae480f 8313 valkey_8.1.1+dfsg1-3+deb13u3_source.buildinfo Files: c735994ea656b54880d416cd703ebdd8 2271 database optional valkey_8.1.1+dfsg1-3+deb13u3.dsc 3ec2c18e27d75a0736caa812c2718c41 2726128 database optional valkey_8.1.1+dfsg1.orig.tar.xz a8ce68eb833eb06745cbdf3ddc362200 37428 database optional valkey_8.1.1+dfsg1-3+deb13u3.debian.tar.xz 2f6adb91f754db88a05299efdbcc5a3f 8313 database optional valkey_8.1.1+dfsg1-3+deb13u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJEBAEBCgAuFiEEY+78PeFNUUbOfyS/NLitfZUp55MFAmrfeT0QHGxlbmFAZGVi aWFuLm9yZwAKCRA0uK19lSnnk2RfD/91CCNNEe0FVWVC9OTI9AXOEA63y8FJlu6v htqs5Rr6aCeNTsIn+SOSTDnEFDqBJKGlRpRECaNuge031ASrlbNrE+UnxWZZweaY RsEH4hcLS0SM9ZmoclAvdO59AC33E1VEEK81MsC5EQJQwtWfaNmwCI46rW5Xtz0P 472I2WmbcSJ+Np+qQtnU4UvelCXhVCVm4Da9jAbozXqSqGjey+LrZbb2ag8jfcHB Qnx4zeq2XUb78Ps3Q604vF83ArGcg1sgNIFtMcbvIsCUDj1YeT2Z3PoJI7UcOtGp HldgtnjVQ9koA3iUO4fYMWJuhtrbSeTw4V2+twyqbiyQGLyxrzSpRyzHhsMMwg17 hPk4GH84fD0h4RvJmZjCfS2kcP5AyhuH6qCzd6ZIheb9x9MHji9oH6KQryqXE9u8 yF24RZjYrf9LT4nGjMa3uFEKNAFh3uJoUbaLS3iaghrYd/rJ8ZhO33wt+TXLliKW Qu3YZNul/iM2BLebIm/CigTJcNp6kQgGpDVucs5ctSoz5PmhzQXmG+AkZwSQvGg3 GV+Wq1Fi3Yis2hiFwU/iuxCDNLq5Pklc/PDb3tCvw/ZX2ip+OsCloxaqekT/APBk XTbTdbJqismcTxVIeDq09ne36dAWTy8NyJGAvaNBDBCLToW6V9x18tGZ/FZqbx4/ euxMFQ4jvw== =ht1c -----END PGP SIGNATURE-----
