Your message dated Sun, 13 Sep 2026 03:18:56 +0000
with message-id <[email protected]>
and subject line Bug#1146641: fixed in valkey 9.1.2-1
has caused the Debian Bug report #1146641,
regarding valkey: CVE-2026-82631 CVE-2026-82677
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146641: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146641
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: valkey
Version: 9.1.1-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 8.1.1+dfsg1-1
Hi,
The following vulnerabilities were published for valkey.
CVE-2026-82631[0]:
| A security flaw has been discovered in valkey-io valkey 9.1.0. The
| affected element is the function handleClientsBlockedOnKey of the
| file src/blocked.c of the component Blocked-on-keys Subsystem. The
| manipulation results in use after free. The attack may be performed
| from remote. A high complexity level is associated with this attack.
| The exploitability is described as difficult. The exploit has been
| released to the public and may be used for attacks. The patch is
| identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a
| patch is advised to resolve this issue.
CVE-2026-82677[1]:
| A vulnerability was determined in valkey-io valkey 9.1.0. Impacted
| is the function moduleTimerHandler of the file src/module.c of the
| component Module Timer Subsystem. This manipulation causes double
| free. The attack can be initiated remotely. The exploit has been
| publicly disclosed and may be utilized. Patch name:
| b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is
| recommended to deploy a patch.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-82631
https://www.cve.org/CVERecord?id=CVE-2026-82631
[1] https://security-tracker.debian.org/tracker/CVE-2026-82677
https://www.cve.org/CVERecord?id=CVE-2026-82677
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: valkey
Source-Version: 9.1.2-1
Done: Lena Voytek <[email protected]>
We believe that the bug you reported is fixed in the latest version of
valkey, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Lena Voytek <[email protected]> (supplier of updated valkey package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 12 Sep 2026 22:36:42 -0400
Source: valkey
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 9.1.2-1
Distribution: unstable
Urgency: medium
Maintainer: Lucas Kanashiro <[email protected]>
Changed-By: Lena Voytek <[email protected]>
Closes: 1146641 1146879 1147517
Changes:
valkey (9.1.2-1) unstable; urgency=medium
.
* New upstream version 9.1.2 (Closes: #1146641, #1146879, #1147517).
- Fix CVE-2026-82631, CVE-2026-82677, CVE-2026-85522, and CVE-2026-86227.
* Remove 0006-Fix-test-cert-gen-and-tls-tests.patch - fixed upstream.
Checksums-Sha1:
e92e3285066c438db99c850c802949379c3340e5 2251 valkey_9.1.2-1.dsc
f9faa46df0782fe6237dd977b3074c5316df3558 4418246 valkey_9.1.2.orig.tar.gz
d6c9e76f01c389d1d1188bc13581c05022a3d930 17752 valkey_9.1.2-1.debian.tar.xz
8d715f036d8eb8d654520cdd1af81722a75e9dc4 8464 valkey_9.1.2-1_source.buildinfo
Checksums-Sha256:
637995b2db343b75ae655fdb458b1f14f9b9b6f913f6144bdb9764b51b2ce2b2 2251
valkey_9.1.2-1.dsc
8e8557da7426a51b4e0fb514a65ef6241dc7c85cb408243af389070abf379cec 4418246
valkey_9.1.2.orig.tar.gz
e83701e1f5140721fe85cbe11bfdbf9b4bb841b6d423644977fbfd2ee417a629 17752
valkey_9.1.2-1.debian.tar.xz
bb82088b64d672cfde1a4bf2c25bdf8ad0a544a53733bc69646c1e175336aede 8464
valkey_9.1.2-1_source.buildinfo
Files:
78f2270d238ad42769b1e8ab06c68f02 2251 database optional valkey_9.1.2-1.dsc
2f87e9ed4a98c093d85e2f90474498a7 4418246 database optional
valkey_9.1.2.orig.tar.gz
a641efebc34cb3f65c19782738c9f5eb 17752 database optional
valkey_9.1.2-1.debian.tar.xz
eb399451c70619dd7efa43e9b6b3b46f 8464 database optional
valkey_9.1.2-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJEBAEBCgAuFiEEY+78PeFNUUbOfyS/NLitfZUp55MFAmqmEiEQHGxlbmFAZGVi
aWFuLm9yZwAKCRA0uK19lSnnk0glD/9zXNHyWCw+GsP61xKT+KSsW2Zvt0KEMH7N
fplzkIp505A0MU14Q8PWuytthe+kCe1QbsuxmNYAf+WWuY863W0RkK1qan55Go2/
YR53PE25ycIuoHDGI6ISDJJO0qy6AvcPtPAXf2iqnLt3ZlFx1+d/pK10oGh6x5hQ
jA3pJihYREolGk6Q2IMElQ85bXruvQYdxdAhN+OiZlktUYD4b1oPoNCK2tWJc3Jt
MnFqydMEAHnszL+q2SfPZ/U1TopmDpgafsEI9dFAk/fc1v/VY9WL3PoYRlVZAR4g
D3MPuf1d66lkdMrKqwr95kxx6sU/H0yNdJFBvHMbP+OOylJshDlHBb44dyYVcQyv
6ZWUSkh9mUA/1e/MaayO0M63V+vLsXEz+m+WnbCoNBc+Vv58snA4+G1iubG0GKRK
MnGp6uTt3RmfEv5BC2OiJsZqJsZ9d2VeTzv3htbQ0t5D1l5z1NKoMInmpuizeqie
Z3oCUuTKVbNKRo9HYxVgdB4omCRh9RgaO4w35TTYWNPA2tTrAEGRSe+yE5ysMeKQ
IOSol+vKEkvFv08ze3Ok5kSo6mC2d5cqRNPo3nv7I3UVyzxReSqJes9Ws7Znmymk
ytAEI85u9jLOnnSLpWDGoryDpSpkm/uhmKrNFFStDmOqNhRpqrWweLO8Nh/g2iaC
Zd0x20ETNg==
=TZ+V
-----END PGP SIGNATURE-----
pgpdEJlRvSK6o.pgp
Description: PGP signature
--- End Message ---
