-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 24 Oct 2026 10:19:26 -0500
Source: valkey
Binary: valkey-sentinel valkey-server valkey-tools valkey-tools-dbgsym
Architecture: arm64
Version: 8.1.1+dfsg1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: arm64 Build Daemon (arm-ubc-01) <buildd_arm64-arm-ubc-01@buildd.debian.org>
Changed-By: Lena Voytek <lena@debian.org>
Description:
 valkey-sentinel - Persistent key-value database with network interface (monitoring)
 valkey-server - Persistent key-value database with network interface
 valkey-tools - Persistent key-value database with network interface (client)
Closes: 1144956 1144957 1146641
Changes:
 valkey (8.1.1+dfsg1-3+deb13u3) trixie-security; urgency=medium
 .
   * Fix CVE-2026-56684 (Closes: #1144956)
     Valkey's tlsProcessPendingData function iterates pending_list while an
     authenticated client can trigger CLIENT KILL, causing connTLSClose to
     delete the iterator's cached next node and producing a use-after-free that
     can crash the server or potentially allow remote code execution when TLS is
     enabled.
     - d/p/CVE-2026-56684.patch
   * Fix CVE-2026-63639 (Closes: #1144957)
     Valkey's RESTORE command accepts a malformed RDB stream payload that
     assigns one Pending Entry List NACK to multiple consumers during stream
     consumer-group deserialization, causing a use-after-free when one consumer
     is deleted while another still references the shared NACK and potentially
     allowing remote code execution.
     - d/p/CVE-2026-63639.patch
   * Fix CVE-2026-82631 and CVE-2026-82677 (Closes: #1146641)
     A server-side use-after-free can occur in handleClientsBlockedOnKey.
     - d/p/CVE-2026-82631.patch
     A server-side double free can occur in moduleTimerHandler.
     - d/p/CVE-2026-82677.patch
   * Fix CVE-2026-23479
     Valkey's unblockClientOnKey function re-executes a blocked client's
     pending command and then accesses the client without checking whether it
     was freed during processing, causing a use-after-free.
     - d/p/CVE-2026-23479.patch
   * Fix CVE-2026-23631
     Valkey frees the functions/scripting engine before loading the RDB during
     a replica full sync, which can happen while a Lua script is yielding via
     the long-command mechanism, causing a use-after-free when the script
     resumes.
     - d/p/CVE-2026-23631.patch
   * Fix CVE-2026-25243
     Valkey's zipmapValidateIntegrity function accepts overlong length
     encodings that zipmapNext later interprets differently, allowing a crafted
     RESTORE payload to cause a heap buffer over-read during zipmap to listpack
     conversion.
     - d/p/CVE-2026-25243.patch
Checksums-Sha1:
 1e5621f6ee41b2bec2e3de76bf06528ae9df983e 23776 valkey-sentinel_8.1.1+dfsg1-3+deb13u3_arm64.deb
 1ddde7721664124594893fab5358d996075b14b0 59204 valkey-server_8.1.1+dfsg1-3+deb13u3_arm64.deb
 3ffa1b127f88ffe0b7cc9f90d82e32ec4364eade 4654536 valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_arm64.deb
 ac2caa39ff016ef772a6458e6cc53ec101112133 1123860 valkey-tools_8.1.1+dfsg1-3+deb13u3_arm64.deb
 83657c7f12e74e0cbd60c79684ed9adf8877d661 7634 valkey_8.1.1+dfsg1-3+deb13u3_arm64-buildd.buildinfo
Checksums-Sha256:
 87305cd1c06d7585a79ee1a4f49f7d36581361ef3cffd81fc60da9a0b5f76f40 23776 valkey-sentinel_8.1.1+dfsg1-3+deb13u3_arm64.deb
 0cd05b8fdfd9de573a4cb630f3c76017340330879be90e41bcae28a3d7d98973 59204 valkey-server_8.1.1+dfsg1-3+deb13u3_arm64.deb
 0c7a028e4b550fce4e1def814e6328e0e650edbc986061ea7cb3157edd844408 4654536 valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_arm64.deb
 c9c0b3637659cec4f2a6095a3873343fc56fd4690ad3cc0143b74d94dd86720c 1123860 valkey-tools_8.1.1+dfsg1-3+deb13u3_arm64.deb
 198a03da8cd8358a9d3f13beacb4eb8351c2dd10fb4a48f8a247fe6cc3469f8c 7634 valkey_8.1.1+dfsg1-3+deb13u3_arm64-buildd.buildinfo
Files:
 4d1f2c951a1495b59e09120069ed9c02 23776 database optional valkey-sentinel_8.1.1+dfsg1-3+deb13u3_arm64.deb
 30ecdb3f4f38f4128b1c8a8938b4bde8 59204 database optional valkey-server_8.1.1+dfsg1-3+deb13u3_arm64.deb
 0883f016390c6f631e537d96edb0905d 4654536 debug optional valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_arm64.deb
 7e5d9ba35255e0b069e398cc8759d30a 1123860 database optional valkey-tools_8.1.1+dfsg1-3+deb13u3_arm64.deb
 16cca35e9c3b937bf7c90c75abb0883a 7634 database optional valkey_8.1.1+dfsg1-3+deb13u3_arm64-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0Ha//LlsGOpbQ/H4xqCFmsOWgoYFAmrfxEMACgkQxqCFmsOW
gobFdQ//bl7nOGT7XFBqpQ4aTBtNT+hgGJBFuvotPlE1Jk/MWA4giKtIM9mvF8t2
WAqZyT4aMGGy/oafAqCiDz3lKXADBvk54Ve71xr69aMihXWKn6pe6DiRzVsw9ple
g9ZhyWUKqDDZXPE/Rx2jevG1LmcjHaUv2i1XxAWU9FyzowfuWp43nPeFSSbhy02c
A5ZrQllkNwvcvX+Z7X1iLXqFa5snr5Apxoh7NeBTyszO2Ux3whW0v3Z3K/HYHF/G
S+IR38FWgxGzO5sjlSzE6yt3ZrYfBxmDqUhMHMrFkDLajLJbf6vp34MQvegOUMlD
d8GB/yxXJsuCq/AdZ31D7D3HvlxA0SC2D52nPijEkAKpb1OhSdWLE77g875Emj2s
LDp5Rytxu3SvsUvD7vc/3ZovG+xQ/hCXqMwrifOEdY5VUeMMs/RZL/CEr5HK7nvU
hQ6GFNK32mjpDwUEdd2LlIlLFCftZ9AA7dgfAKzaSqf5DwQAEPnqrXwWzQFy9UHa
4XTN1OgwWzYsQ9PrwqlEVEPPHjOf1YWDewclIu5sy34WCEbOwuIFcQftUMWjKGc4
JX5jfwnqeUUQHR/IXoWYXkMqqjg95ujC5oE510vTl4PqZ2VJwiRrpH11vIneh7vX
Ko0pvpnBaVUNFcvSMZU01ojk0EdRYfJgV9UF1FjlZxuPd5ZqRh8=
=rcVU
-----END PGP SIGNATURE-----