-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 24 Oct 2026 10:19:26 -0500
Source: valkey
Binary: valkey-sentinel valkey-server valkey-tools valkey-tools-dbgsym
Architecture: armhf
Version: 8.1.1+dfsg1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: armhf Build Daemon (arm-conova-03) <buildd_arm64-arm-conova-03@buildd.debian.org>
Changed-By: Lena Voytek <lena@debian.org>
Description:
 valkey-sentinel - Persistent key-value database with network interface (monitoring)
 valkey-server - Persistent key-value database with network interface
 valkey-tools - Persistent key-value database with network interface (client)
Closes: 1144956 1144957 1146641
Changes:
 valkey (8.1.1+dfsg1-3+deb13u3) trixie-security; urgency=medium
 .
   * Fix CVE-2026-56684 (Closes: #1144956)
     Valkey's tlsProcessPendingData function iterates pending_list while an
     authenticated client can trigger CLIENT KILL, causing connTLSClose to
     delete the iterator's cached next node and producing a use-after-free that
     can crash the server or potentially allow remote code execution when TLS is
     enabled.
     - d/p/CVE-2026-56684.patch
   * Fix CVE-2026-63639 (Closes: #1144957)
     Valkey's RESTORE command accepts a malformed RDB stream payload that
     assigns one Pending Entry List NACK to multiple consumers during stream
     consumer-group deserialization, causing a use-after-free when one consumer
     is deleted while another still references the shared NACK and potentially
     allowing remote code execution.
     - d/p/CVE-2026-63639.patch
   * Fix CVE-2026-82631 and CVE-2026-82677 (Closes: #1146641)
     A server-side use-after-free can occur in handleClientsBlockedOnKey.
     - d/p/CVE-2026-82631.patch
     A server-side double free can occur in moduleTimerHandler.
     - d/p/CVE-2026-82677.patch
   * Fix CVE-2026-23479
     Valkey's unblockClientOnKey function re-executes a blocked client's
     pending command and then accesses the client without checking whether it
     was freed during processing, causing a use-after-free.
     - d/p/CVE-2026-23479.patch
   * Fix CVE-2026-23631
     Valkey frees the functions/scripting engine before loading the RDB during
     a replica full sync, which can happen while a Lua script is yielding via
     the long-command mechanism, causing a use-after-free when the script
     resumes.
     - d/p/CVE-2026-23631.patch
   * Fix CVE-2026-25243
     Valkey's zipmapValidateIntegrity function accepts overlong length
     encodings that zipmapNext later interprets differently, allowing a crafted
     RESTORE payload to cause a heap buffer over-read during zipmap to listpack
     conversion.
     - d/p/CVE-2026-25243.patch
Checksums-Sha1:
 9762367ef7f90832694d522089db3981df0a31ed 23776 valkey-sentinel_8.1.1+dfsg1-3+deb13u3_armhf.deb
 d5a6be2931de746a2ee565cfda5b0734527c66d1 59204 valkey-server_8.1.1+dfsg1-3+deb13u3_armhf.deb
 0ba242b6c30029c7167e0f3b0f9482845f00c472 4258292 valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_armhf.deb
 a968a1568f2b4851a64b729a5c70315a5fc4dccc 1093508 valkey-tools_8.1.1+dfsg1-3+deb13u3_armhf.deb
 2258bc6eab769ce5ffc658811fa7b7df3117a567 7516 valkey_8.1.1+dfsg1-3+deb13u3_armhf-buildd.buildinfo
Checksums-Sha256:
 eeb0954b839056de57e7280110b4b6afa15c7169379fe8a4738371d348eecef2 23776 valkey-sentinel_8.1.1+dfsg1-3+deb13u3_armhf.deb
 10319b30950fb5b14130e7ed5ac665d6fa05ca11a6149efd4b0f0cb1dabb68da 59204 valkey-server_8.1.1+dfsg1-3+deb13u3_armhf.deb
 88f78867dda513879f98ebefdc11841b6f48a9a996e6858d094b9271bd99f59c 4258292 valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_armhf.deb
 5d78dc3521cf5502eb40e9956ab8d751792eaeaf5d3840de3d7b08fcd003fe9c 1093508 valkey-tools_8.1.1+dfsg1-3+deb13u3_armhf.deb
 d293866efb08cd3055d04e7c5aad4b5d4d56a06afc6e43580e252cf8215ed098 7516 valkey_8.1.1+dfsg1-3+deb13u3_armhf-buildd.buildinfo
Files:
 b1884f7cb8f1f95eca6c0598bb13882d 23776 database optional valkey-sentinel_8.1.1+dfsg1-3+deb13u3_armhf.deb
 2780372bd4c5ccde183dd41b4893ea53 59204 database optional valkey-server_8.1.1+dfsg1-3+deb13u3_armhf.deb
 6f80369626f70660645164b505efbede 4258292 debug optional valkey-tools-dbgsym_8.1.1+dfsg1-3+deb13u3_armhf.deb
 79a5dcb8ec86186b3ceb205dcc1fcfc8 1093508 database optional valkey-tools_8.1.1+dfsg1-3+deb13u3_armhf.deb
 fd7e1c264fd0bbd233285d0aa456f8bb 7516 database optional valkey_8.1.1+dfsg1-3+deb13u3_armhf-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmrfxK0ACgkQXVp1sEH/
1mLC2A//Y7VQnrWRePmNdMwdgH9nM6gGh/JDwgOeKH1n3c3/0C8T5GidVwFXBzN1
QPq1PNKkVcyABr8Hc/rIfin6Rcm4j+i3GjjsgLqg3txBIpWp+PBjhtAqNrcvHu5U
xZ3rK1FyLNGYfBHW+FVwFRVINq1Z/qnu6EWpVcnfH4dKCQGeOMadmdB/4MXjn2RK
QBHz37LoXP1VTb+ALtBXakNhOBgd7OYLW8ri6WWTTvCu4oj8sMEZD+UcUYr91emt
3IvDhqOAjXAHmBfn23NWHkyz+OhlEi4Evayh9tyhBQTxhDFiGrlPVOZqAB3gHrcT
i7xSja/dwyhwj3sW/lf2cm23hWzJBS62UqHCjh97ATVwNL/GT5+hNJH9iYyoCqr8
PgSVvHQn+F/NDKmEPIuX0K7OtTL59VXkPHE3k3UOJaG2qabrDRIc2lTI1jJc6LKL
mhBmmv1PtwYkHeFPpGyhk2Yu7xqlOAxjRfPDor+pCni1fG2HfBDRIjcdIazX6C5n
0v+kBlyNGeJ6OyGh/jvPW5VFQdbTSFKYwa+LhVOpRZDgmXarm4TJTthBT7h8vxmw
U1/tmQNIYel537uzvZ6CsNBVvmt0Bnlc7mha6xXbBpBPkMJv6O6jX/aXdFMMNWqc
9JK+KXKG694lbFbjs9k3NbYHOZBFy1Ei55jcUzj7O8kXdzQsZrY=
=5J+x
-----END PGP SIGNATURE-----