Your message dated Thu, 29 Oct 2026 13:30:16 +0000
with message-id <[email protected]>
and subject line Bug#1146641: fixed in valkey 8.1.1+dfsg1-3+deb13u3
has caused the Debian Bug report #1146641,
regarding valkey: CVE-2026-82631 CVE-2026-82677
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146641: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146641
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: valkey
Version: 9.1.1-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 8.1.1+dfsg1-1
Hi,
The following vulnerabilities were published for valkey.
CVE-2026-82631[0]:
| A security flaw has been discovered in valkey-io valkey 9.1.0. The
| affected element is the function handleClientsBlockedOnKey of the
| file src/blocked.c of the component Blocked-on-keys Subsystem. The
| manipulation results in use after free. The attack may be performed
| from remote. A high complexity level is associated with this attack.
| The exploitability is described as difficult. The exploit has been
| released to the public and may be used for attacks. The patch is
| identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a
| patch is advised to resolve this issue.
CVE-2026-82677[1]:
| A vulnerability was determined in valkey-io valkey 9.1.0. Impacted
| is the function moduleTimerHandler of the file src/module.c of the
| component Module Timer Subsystem. This manipulation causes double
| free. The attack can be initiated remotely. The exploit has been
| publicly disclosed and may be utilized. Patch name:
| b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is
| recommended to deploy a patch.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-82631
https://www.cve.org/CVERecord?id=CVE-2026-82631
[1] https://security-tracker.debian.org/tracker/CVE-2026-82677
https://www.cve.org/CVERecord?id=CVE-2026-82677
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: valkey
Source-Version: 8.1.1+dfsg1-3+deb13u3
Done: Lena Voytek <[email protected]>
We believe that the bug you reported is fixed in the latest version of
valkey, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Lena Voytek <[email protected]> (supplier of updated valkey package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 10:19:26 -0500
Source: valkey
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 8.1.1+dfsg1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Lucas Kanashiro <[email protected]>
Changed-By: Lena Voytek <[email protected]>
Closes: 1144956 1144957 1146641
Changes:
valkey (8.1.1+dfsg1-3+deb13u3) trixie-security; urgency=medium
.
* Fix CVE-2026-56684 (Closes: #1144956)
Valkey's tlsProcessPendingData function iterates pending_list while an
authenticated client can trigger CLIENT KILL, causing connTLSClose to
delete the iterator's cached next node and producing a use-after-free that
can crash the server or potentially allow remote code execution when TLS is
enabled.
- d/p/CVE-2026-56684.patch
* Fix CVE-2026-63639 (Closes: #1144957)
Valkey's RESTORE command accepts a malformed RDB stream payload that
assigns one Pending Entry List NACK to multiple consumers during stream
consumer-group deserialization, causing a use-after-free when one consumer
is deleted while another still references the shared NACK and potentially
allowing remote code execution.
- d/p/CVE-2026-63639.patch
* Fix CVE-2026-82631 and CVE-2026-82677 (Closes: #1146641)
A server-side use-after-free can occur in handleClientsBlockedOnKey.
- d/p/CVE-2026-82631.patch
A server-side double free can occur in moduleTimerHandler.
- d/p/CVE-2026-82677.patch
* Fix CVE-2026-23479
Valkey's unblockClientOnKey function re-executes a blocked client's
pending command and then accesses the client without checking whether it
was freed during processing, causing a use-after-free.
- d/p/CVE-2026-23479.patch
* Fix CVE-2026-23631
Valkey frees the functions/scripting engine before loading the RDB during
a replica full sync, which can happen while a Lua script is yielding via
the long-command mechanism, causing a use-after-free when the script
resumes.
- d/p/CVE-2026-23631.patch
* Fix CVE-2026-25243
Valkey's zipmapValidateIntegrity function accepts overlong length
encodings that zipmapNext later interprets differently, allowing a crafted
RESTORE payload to cause a heap buffer over-read during zipmap to listpack
conversion.
- d/p/CVE-2026-25243.patch
Checksums-Sha1:
3fdb869674f775b590e8444354210dbb843ee8c4 2271 valkey_8.1.1+dfsg1-3+deb13u3.dsc
40f52feab50d74dc579abf6702429bbd080dce39 2726128 valkey_8.1.1+dfsg1.orig.tar.xz
0ea6d03241018dfdef03dd0588504f9b3d26226a 37428
valkey_8.1.1+dfsg1-3+deb13u3.debian.tar.xz
06132185cb9e8a10993ba3e6500083ecb568b1b2 8313
valkey_8.1.1+dfsg1-3+deb13u3_source.buildinfo
Checksums-Sha256:
317246ffea280a14427d83f059a0696f1aef51247b30d7f1675f45849ea5d774 2271
valkey_8.1.1+dfsg1-3+deb13u3.dsc
d9bbd82eecb82f359e649a0007ad3dc1b47cc15afa626348ca86b73c4ae2c7ee 2726128
valkey_8.1.1+dfsg1.orig.tar.xz
d3c5f3bf8d880abd0aff543509d9226a8f2b64037cdfb165f597d45888bb0aea 37428
valkey_8.1.1+dfsg1-3+deb13u3.debian.tar.xz
a5f255502c8f07732727bebc17ebed015b5bf365b016eb8769b1d6df29ae480f 8313
valkey_8.1.1+dfsg1-3+deb13u3_source.buildinfo
Files:
c735994ea656b54880d416cd703ebdd8 2271 database optional
valkey_8.1.1+dfsg1-3+deb13u3.dsc
3ec2c18e27d75a0736caa812c2718c41 2726128 database optional
valkey_8.1.1+dfsg1.orig.tar.xz
a8ce68eb833eb06745cbdf3ddc362200 37428 database optional
valkey_8.1.1+dfsg1-3+deb13u3.debian.tar.xz
2f6adb91f754db88a05299efdbcc5a3f 8313 database optional
valkey_8.1.1+dfsg1-3+deb13u3_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJEBAEBCgAuFiEEY+78PeFNUUbOfyS/NLitfZUp55MFAmrfeT0QHGxlbmFAZGVi
aWFuLm9yZwAKCRA0uK19lSnnk2RfD/91CCNNEe0FVWVC9OTI9AXOEA63y8FJlu6v
htqs5Rr6aCeNTsIn+SOSTDnEFDqBJKGlRpRECaNuge031ASrlbNrE+UnxWZZweaY
RsEH4hcLS0SM9ZmoclAvdO59AC33E1VEEK81MsC5EQJQwtWfaNmwCI46rW5Xtz0P
472I2WmbcSJ+Np+qQtnU4UvelCXhVCVm4Da9jAbozXqSqGjey+LrZbb2ag8jfcHB
Qnx4zeq2XUb78Ps3Q604vF83ArGcg1sgNIFtMcbvIsCUDj1YeT2Z3PoJI7UcOtGp
HldgtnjVQ9koA3iUO4fYMWJuhtrbSeTw4V2+twyqbiyQGLyxrzSpRyzHhsMMwg17
hPk4GH84fD0h4RvJmZjCfS2kcP5AyhuH6qCzd6ZIheb9x9MHji9oH6KQryqXE9u8
yF24RZjYrf9LT4nGjMa3uFEKNAFh3uJoUbaLS3iaghrYd/rJ8ZhO33wt+TXLliKW
Qu3YZNul/iM2BLebIm/CigTJcNp6kQgGpDVucs5ctSoz5PmhzQXmG+AkZwSQvGg3
GV+Wq1Fi3Yis2hiFwU/iuxCDNLq5Pklc/PDb3tCvw/ZX2ip+OsCloxaqekT/APBk
XTbTdbJqismcTxVIeDq09ne36dAWTy8NyJGAvaNBDBCLToW6V9x18tGZ/FZqbx4/
euxMFQ4jvw==
=ht1c
-----END PGP SIGNATURE-----
pgp0Z30QnKn9v.pgp
Description: PGP signature
--- End Message ---
