-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 24 Oct 2026 10:19:26 -0500
Source: valkey
Binary: valkey-sentinel valkey-server valkey-tools valkey-tools-dbgsym
Architecture: amd64
Version: 8.1.1+dfsg1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: amd64 / i386 Build Daemon (x86-csail-01) <buildd_amd64-x86-csail-01@buildd.debian.org>
Changed-By: Lena Voytek <lena@debian.org>
Description:
 valkey-sentinel - Persistent key-value database with network interface (monitoring)
 valkey-server - Persistent key-value database with network interface
 valkey-tools - Persistent key-value database with network interface (client)
Closes: 1144956 1144957 1146641
Changes:
 valkey (8.1.1+dfsg1-3+deb13u3) trixie-security; urgency=medium
 .
   * Fix CVE-2026-56684 (Closes: #1144956)
     Valkey's tlsProcessPendingData function iterates pending_list while an
     authenticated client can trigger CLIENT KILL, causing connTLSClose to
     delete the iterator's cached next node and producing a use-after-free that
     can crash the server or potentially allow remote code execution when TLS is
     enabled.
     - d/p/CVE-2026-56684.patch
   * Fix CVE-2026-63639 (Closes: #1144957)
     Valkey's RESTORE command accepts a malformed RDB stream payload that
     assigns one Pending Entry List NACK to multiple consumers during stream
     consumer-group deserialization, causing a use-after-free when one consumer
     is deleted while another still references the shared NACK and potentially
     allowing remote code execution.
     - d/p/CVE-2026-63639.patch
   * Fix CVE-2026-82631 and CVE-2026-82677 (Closes: #1146641)
     A server-side use-after-free can occur in handleClientsBlockedOnKey.
     - d/p/CVE-2026-82631.patch
     A server-side double free can occur in moduleTimerHandler.
     - d/p/CVE-2026-82677.patch
   * Fix CVE-2026-23479
     Valkey's unblockClientOnKey function re-executes a blocked client's
     pending command and then accesses the client without checking whether it
     was freed during processing, causing a use-after-free.
     - d/p/CVE-2026-23479.patch
   * Fix CVE-2026-23631
     Valkey frees the functions/scripting engine before loading the RDB during
     a replica full sync, which can happen while a Lua script is yielding via
     the long-command mechanism, causing a use-after-free when the script
     resumes.
     - d/p/CVE-2026-23631.patch
   * Fix CVE-2026-25243
     Valkey's zipmapValidateIntegrity function accepts overlong length
     encodings that zipmapNext later interprets differently, allowing a crafted
     RESTORE payload to cause a heap buffer over-read during zipmap to listpack
     conversion.
     - d/p/CVE-2026-25243.patch
Checksums-Sha1:
 377657a3eb7f2ee8c4016b2e6aaf83437b9e0bb9 23776 valkey-sentinel_8.1.1+dfsg1-3+deb13u3_amd64.deb
 015dfd9701f452d23138e2853ce534b756148d06 59204 valkey-server_8.1.1+dfsg1-3+deb13u3_amd64.deb
 76cf3ebda627824791ab32cd036c36809b1ecd66 4756936 valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_amd64.deb
 75ef4bbafbebc14219c96339e8d5e3bfd65d1654 1216140 valkey-tools_8.1.1+dfsg1-3+deb13u3_amd64.deb
 c7e35665cfb6cd4f7f754af60f4cb51d7bff124e 7650 valkey_8.1.1+dfsg1-3+deb13u3_amd64-buildd.buildinfo
Checksums-Sha256:
 9db6ce83ebf9490e8bbc61ad3319bcba626836c5bc34fd3d083210af2d150fdb 23776 valkey-sentinel_8.1.1+dfsg1-3+deb13u3_amd64.deb
 41ea4e273d45d54a7d6c20361efdb95bbc57590bc4ef8c1ef13220d589fc2c3a 59204 valkey-server_8.1.1+dfsg1-3+deb13u3_amd64.deb
 9fe891b2cabe167926c356d56b8e2d3e7b441b871de48414adf01af709ea1f7e 4756936 valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_amd64.deb
 0c800fe97e57ec7e8e71a147a0d1119955ffd6d083e73618ce946a44d3b827dd 1216140 valkey-tools_8.1.1+dfsg1-3+deb13u3_amd64.deb
 195313f6354117a3ddbe04560e5bb99c5f58ee97c55408da7f9a747fedd41dce 7650 valkey_8.1.1+dfsg1-3+deb13u3_amd64-buildd.buildinfo
Files:
 a192fb72c6d08a728d75bfaef0f4c6ba 23776 database optional valkey-sentinel_8.1.1+dfsg1-3+deb13u3_amd64.deb
 c202265ee22b1b89bbe8e3f0a95bd7e2 59204 database optional valkey-server_8.1.1+dfsg1-3+deb13u3_amd64.deb
 d4fab723a36a93a54b077ca5246f7e5d 4756936 debug optional valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_amd64.deb
 fb0fae174fc83b9dbf12e100ca71f0c6 1216140 database optional valkey-tools_8.1.1+dfsg1-3+deb13u3_amd64.deb
 a199f2d46d785374f8f8568ff777c4cd 7650 database optional valkey_8.1.1+dfsg1-3+deb13u3_amd64-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBDWXQb2umOtH4DRpYg9P9sm2dfEFAmrfuV0ACgkQYg9P9sm2
dfFfyw//eGQCTgy0m5x1mQcmuOAl9+Q77v1+xWjtJpWgBQj7usobI6jB/8jA5YVt
Q1NKI3hKTmdNuv3sRxXTe7VmT6HwXb/A7hguYBK4t8SrLuhlAhnV3B472LGWJWLf
cT9ITwDo8Q5WRL16epr0or9URL9qhNYK+7ZIZc6yHOj4or5qkO4eOLPcAthCAwKc
c5atYgZTq6OoTjxXlgOcwvoFGIzOGIQt4NDQjHvng8axcDJumglE5DNau3P0iLly
rbCcAmfQRHYC0xTXMSur/NZer8Bk3LpDXvgetC8AyBCj/T+kgLOT19evkcw0fQkE
vJpcDJ1HXSx2lw1ut70CYOKSgZYgFKuXRoItHDW7CEmf34f/46ikyJ01MzJM5g/D
mxZzHNZb/ykDoRHbOJkUXeZgbG0yE+RiVkJCQRl75EutQHVQBMkPp8EGp5oznLug
kyGzUxzYZ8dcW6cV1zEhrr6tIgqcOt6MMe2tFYlpFlBlejSq/NLG7ZuT/U7+WgaN
CU1WDv9+gJmBmNflx0Z0ZZUWK0/8xOEVEoyUf/kzp7WtHe2DaC5nE0KYm2a7kWlh
SLJV25dh1yR5Or1V9LyX5H1V4IMAkuqrNxKgY2xoouT/ahgiL4C7M2yYfb8oLmBF
yW67LZXfIuxpX6GZKZ2HncnAw4EZS3ADLS776Bz9xa8hYyQX3VA=
=juQX
-----END PGP SIGNATURE-----