-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 24 Oct 2026 10:19:26 -0500
Source: valkey
Binary: valkey-sentinel valkey-server valkey-tools valkey-tools-dbgsym
Architecture: i386
Version: 8.1.1+dfsg1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) <buildd_amd64-x86-ubc-02@buildd.debian.org>
Changed-By: Lena Voytek <lena@debian.org>
Description:
 valkey-sentinel - Persistent key-value database with network interface (monitoring)
 valkey-server - Persistent key-value database with network interface
 valkey-tools - Persistent key-value database with network interface (client)
Closes: 1144956 1144957 1146641
Changes:
 valkey (8.1.1+dfsg1-3+deb13u3) trixie-security; urgency=medium
 .
   * Fix CVE-2026-56684 (Closes: #1144956)
     Valkey's tlsProcessPendingData function iterates pending_list while an
     authenticated client can trigger CLIENT KILL, causing connTLSClose to
     delete the iterator's cached next node and producing a use-after-free that
     can crash the server or potentially allow remote code execution when TLS is
     enabled.
     - d/p/CVE-2026-56684.patch
   * Fix CVE-2026-63639 (Closes: #1144957)
     Valkey's RESTORE command accepts a malformed RDB stream payload that
     assigns one Pending Entry List NACK to multiple consumers during stream
     consumer-group deserialization, causing a use-after-free when one consumer
     is deleted while another still references the shared NACK and potentially
     allowing remote code execution.
     - d/p/CVE-2026-63639.patch
   * Fix CVE-2026-82631 and CVE-2026-82677 (Closes: #1146641)
     A server-side use-after-free can occur in handleClientsBlockedOnKey.
     - d/p/CVE-2026-82631.patch
     A server-side double free can occur in moduleTimerHandler.
     - d/p/CVE-2026-82677.patch
   * Fix CVE-2026-23479
     Valkey's unblockClientOnKey function re-executes a blocked client's
     pending command and then accesses the client without checking whether it
     was freed during processing, causing a use-after-free.
     - d/p/CVE-2026-23479.patch
   * Fix CVE-2026-23631
     Valkey frees the functions/scripting engine before loading the RDB during
     a replica full sync, which can happen while a Lua script is yielding via
     the long-command mechanism, causing a use-after-free when the script
     resumes.
     - d/p/CVE-2026-23631.patch
   * Fix CVE-2026-25243
     Valkey's zipmapValidateIntegrity function accepts overlong length
     encodings that zipmapNext later interprets differently, allowing a crafted
     RESTORE payload to cause a heap buffer over-read during zipmap to listpack
     conversion.
     - d/p/CVE-2026-25243.patch
Checksums-Sha1:
 996d7def28b26df3345f607c26baa3541f8b1c00 23776 valkey-sentinel_8.1.1+dfsg1-3+deb13u3_i386.deb
 f908fd7f906652b22b2a0e2c1f25034cbadb5b20 59204 valkey-server_8.1.1+dfsg1-3+deb13u3_i386.deb
 c279ad82b1c27a832c36cc2e60c7109fcbf2c962 4362032 valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_i386.deb
 60a851a49193a89c10de16257d7c9dd1b32fbbb5 1211992 valkey-tools_8.1.1+dfsg1-3+deb13u3_i386.deb
 48fc6e353b511a931a241b1d4ad62ab405476ee9 7545 valkey_8.1.1+dfsg1-3+deb13u3_i386-buildd.buildinfo
Checksums-Sha256:
 0d69120e6985ffa9a395788321917b3028558c079bc0a828ff268e94c878d403 23776 valkey-sentinel_8.1.1+dfsg1-3+deb13u3_i386.deb
 2abbf71b5e42841045ee2e98952c60e357318d5e6e7a561ea5f7824392e53c79 59204 valkey-server_8.1.1+dfsg1-3+deb13u3_i386.deb
 5d0197bba9396dcaadf1eafc3ea50a586ed4a1c038a95e2355509d130525dd81 4362032 valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_i386.deb
 37472d11fb414d69e4a31eb8054f67f4779a5a9491217d4874bb0ba62ddf72c6 1211992 valkey-tools_8.1.1+dfsg1-3+deb13u3_i386.deb
 02b3daa3a7c7909bf19405ff5a5ff2362fef0e54bf25afe16634c55a1561d554 7545 valkey_8.1.1+dfsg1-3+deb13u3_i386-buildd.buildinfo
Files:
 bfe44eb8e6fd667f84d383663cd30194 23776 database optional valkey-sentinel_8.1.1+dfsg1-3+deb13u3_i386.deb
 e3358deb7dbacc432bbe43124b9f1452 59204 database optional valkey-server_8.1.1+dfsg1-3+deb13u3_i386.deb
 ebc6ebb9e5af3a80e7424a8efe2da2f8 4362032 debug optional valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_i386.deb
 6c992fecb48aadf6b63df8b3febf8285 1211992 database optional valkey-tools_8.1.1+dfsg1-3+deb13u3_i386.deb
 5384d54924a96c987d0da35304166e06 7545 database optional valkey_8.1.1+dfsg1-3+deb13u3_i386-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEb5EwsJvHBEjqIJYIbheoBegwXLIFAmrfuv4ACgkQbheoBegw
XLLojg/+OrQw8abkdCv92lTQEWNjoFtMuL5gzQeFYQ9xowHyNVTgBk3i50ME4tMg
5vx+hvfriSHnxiHBZoTXvp71AJs/zLe4qVUzITwcBp2GPzSncLccTxdh8OaLLc6X
+elgTCoAfKfJj/dKg0JyRFhYQPN3IN7NTPakoojwOlfTaBeEQ08cTDjyXpp7vtxR
dyXKSVbYCQ/WpbORG5VGuUgsWbpaWCBM6YquP0frxMrMnx/hrnZ6PMelikkVdjf4
4vjBTpN70Y8LNed7Duf3ObpJBXbxQRvTQJkYRmzdwqbUP1BsBlcbJ+037BKinAgk
gmJpKfaxgqIs99J7z+m8Mcw4WSy6c4pSlAM20QZMNrfp3gOJnffG/AvdDHuqq+F6
VGjVB/Z1JslSCucLs2l6qUwfTgRXQ3qHYzf0asuBbNAkzMFUsnuCzM3deOpei6+8
NdXWQ3iHvgG5C/dknVhqEA9LEnM2FR13YGvN7UgOVIa0k9KE2C9R/dp0mfW9NkNW
G4/MXnrAtjtHlf6RFGwADdLQFVw/HGNNNd5p3n9H4/khCLvpy/bbSUgOXEDTja6n
5cyYNH7rh5fbTkUoWcUWbqsS3/EZp+765wWhIiBrt4/eb2KnraYIBbL/60fV7yWk
YTq5q9Jmix6gXFJ3YK8r6+Tr0edTfyQIQUUuRSZZ+snMPsqks5c=
=A0cL
-----END PGP SIGNATURE-----