Your message dated Fri, 02 Oct 2026 15:24:05 +0000
with message-id <[email protected]>
and subject line Bug#1147421: fixed in redis 5:8.0.2-3+deb13u3
has caused the Debian Bug report #1147421,
regarding redis: CVE-2026-23479 CVE-2026-23631 CVE-2026-25243
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147421: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147421
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: redis
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security
Hi,
The following vulnerabilities were published for redis and are fixed
in 8.6.3 and later:
CVE-2026-23479[0]:
| Redis is an in-memory data structure store. In redis-server from
| 7.2.0 until 8.6.3, the unblock client flow does not handle an error
| return from `processCommandAndResetClient` when re-executing a
| blocked command. If a blocked client is evicted during this flow, an
| authenticated attacker can trigger a use-after-free that may lead to
| remote code execution. This has been patched in version 8.6.3.
https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3
https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive
Fixed by:
https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea
(8.6.3)
CVE-2026-23631[1]:
| Redis is an in-memory data structure store. In all versions of
| redis-server with Lua scripting, an authenticated attacker can
| exploit the master-replica synchronization mechanism to trigger a
| use-after-free on replicas where replica-read-only is disabled or
| can be disabled, which may lead to remote code execution. A
| workaround is to prevent users from executing Lua scripts or avoid
| using replicas where replica-read-only is disabled. This is patched
| in version 8.6.3.
https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826
https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica
Fixed by:
https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb
(8.6.3)
CVE-2026-25243[2]:
| Redis is an in-memory data structure store. In versions of redis-
| server up to 8.6.3, the RESTORE command does not properly validate
| serialized values. An authenticated attacker with permission to
| execute RESTORE can supply a crafted serialized payload that
| triggers invalid memory access and may lead to remote code
| execution. A workaround is to restrict access to the RESTORE command
| with ACL rules. This is patched in version 8.6.3.
https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4
https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive
Fixed by:
https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02
(8.6.3)
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-23479
https://www.cve.org/CVERecord?id=CVE-2026-23479
[1] https://security-tracker.debian.org/tracker/CVE-2026-23631
https://www.cve.org/CVERecord?id=CVE-2026-23631
[2] https://security-tracker.debian.org/tracker/CVE-2026-25243
https://www.cve.org/CVERecord?id=CVE-2026-25243
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: redis
Source-Version: 5:8.0.2-3+deb13u3
Done: Aron Xu <[email protected]>
We believe that the bug you reported is fixed in the latest version of
redis, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Aron Xu <[email protected]> (supplier of updated redis package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 15 Sep 2026 00:52:10 +0800
Source: redis
Architecture: source
Version: 5:8.0.2-3+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: Chris Lamb <[email protected]>
Changed-By: Aron Xu <[email protected]>
Closes: 1147421 1147422 1147423
Changes:
redis (5:8.0.2-3+deb13u3) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* CVE-2026-25243: Invalid memory access in RESTORE. The RESTORE
command did not properly validate serialized values; an
authenticated attacker able to run RESTORE could supply a crafted
payload triggering invalid memory access and possibly remote code
execution. (Closes: #1147421)
* CVE-2026-23631: Lua use-after-free on replicas. An authenticated
attacker could exploit the master-replica synchronization mechanism
to trigger a use-after-free on replicas where replica-read-only is
disabled, potentially leading to remote code execution.
(Closes: #1147421)
* CVE-2026-23479: Use-after-free in the unblock client flow. The error
return from processCommandAndResetClient was not handled when re-
executing a blocked command, allowing an authenticated attacker to
trigger a use-after-free and possibly remote code execution.
(Closes: #1147421)
* CVE-2026-66373: Double free via RESTORE of a stream whose NACK is
shared by several consumers, an incomplete fix for CVE-2026-25243;
deleting both consumers with XGROUP DELCONSUMER could lead to remote
code execution. (Closes: #1147422)
* CVE-2026-81934: Use-after-free in tlsProcessPendingData() when
handling the TLS pending-data list. A remote unauthenticated
attacker may be able to execute arbitrary code with the privileges
of the server. (Closes: #1147423)
* Some important fixes upstream shipped as security fixes without CVE:
- From 8.2.9: ACL key-permission bypass in SORT,
GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP, out-of-bounds argv
access during ACL key extraction for wrong-arity KEYNUM commands,
out-of-range SLOT_INFO slot id in RDB loading causing memory corruption,
and a use-after-free in handleClientsBlockedOnKey when reprocessing a
command evicts another client blocked on the same key.
- From 8.0.5: out-of-bounds argv read and crash in HGETEX when the
FIELDS option lacks its numfields argument, and an integer overflow in
the HyperLogLog MurmurHash64A with entries over 2GB.
Checksums-Sha1:
83acdb59ebe5c13300675270aa9bf00de981c89e 1915 redis_8.0.2-3+deb13u3.dsc
7de09e28a46839ddb1f796c7a06d122fa17d11ef 60272
redis_8.0.2-3+deb13u3.debian.tar.xz
ec6117075435f2786cc15223f415b764df953923 6230
redis_8.0.2-3+deb13u3_source.buildinfo
Checksums-Sha256:
31ba0def05d365d9d91691dd559a0026e5e9aa3f30892bc9a68fbd5d4f8a5625 1915
redis_8.0.2-3+deb13u3.dsc
10d40bb9c0a8a3efd6f3d00850fdfafa5f128e842f47a2fbf0d50b3f70e62943 60272
redis_8.0.2-3+deb13u3.debian.tar.xz
d1495e2c9ade69ae7c85742f55c836e92a725e46be26ae5211f3c648994f8481 6230
redis_8.0.2-3+deb13u3_source.buildinfo
Files:
abe51fbd82c2c7b09d7eed816319bb88 1915 database optional
redis_8.0.2-3+deb13u3.dsc
77ff3555b964e4d125b41ecbaef834bc 60272 database optional
redis_8.0.2-3+deb13u3.debian.tar.xz
709cea0e7beb73145bd02c4406dac326 6230 database optional
redis_8.0.2-3+deb13u3_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmq82LwACgkQ+GQ1dHE8
m64wvwf/S3xKoM0J51lK9xW/Palz2mrwZJdyK/cOZTktynSBMCAfr9I/7J1KymXT
CDlw8xKiNhywRSZaodEpH0AQR+EPFRmFwZ5mBgGqc+3WV8O/ecql+KSVVLotrSRf
7uqHefB1FVXi8taY9me4GRkbMcq1rB7ICpyQ44lMO9o6Dpty+VtDFbVUyFJGaSOF
6w3asfwQHsN3CR5iyjvAIvPYKncS6bfDwhXeSUt25uxVcyCIUPGuRhVZcHTDpBZ7
Y+uQmsivxvNP5On0Nc4bbEoRWstCK0ICj8978ZicAYtAYuTL9kxzrr1ot7ixtDU7
Dng4y5wCl4bD+I5czpvP4tzihrhl1Q==
=H+4V
-----END PGP SIGNATURE-----
pgp4SDpGISNcZ.pgp
Description: PGP signature
--- End Message ---
