Public bug reported:
A new release of valkey is available for merging from Debian.
Ubuntu: 9.1.2-0ubuntu1
Debian Unstable: 9.1.2-1
### New Debian Changes ###
valkey (9.1.2-1) unstable; urgency=medium
* New upstream version 9.1.2 (Closes: #1146641, #1146879, #1147517).
- Fix CVE-2026-82631, CVE-2026-82677, CVE-2026-85522, and CVE-2026-86227.
* Remove 0006-Fix-test-cert-gen-and-tls-tests.patch - fixed upstream.
-- Lena Voytek <[email protected]> Sat, 12 Sep 2026 22:36:42 -0400
valkey (9.1.1-1) unstable; urgency=medium
[ Lena Voytek ]
* New upstream version 9.1.1 (Closes: #1144957, #1144956).
- Fix CVE-2026-63639 and CVE-2026-56684.
* Update patches.
- Remove d/p/CVE-2025-67733.patch and CVE-2026-21863.patch already applied
by upstream.
- Refresh 0002-Add-CPPFLAGS-to-upstream-makefiles.patch.
- Use defined() instead of == yes for USE_SYSTEM_JEMALLOC in
0004-Add-support-for-USE_SYSTEM_JEMALLOC-flag.patch.
- Add 0005-Map-je_posix_memalign-for-system-jemalloc.patch to map
je_posix_memalign to posix_memalign for system jemalloc.
- Add 0006-support-openssl4-tlsS-tests.patch to fix TLS unit test failures
and test certificate generation.
* Update watch file.
- Use version 5.
- Remove repack suffix - no longer needed.
- Add uversion-mangle to watch for rc versions.
* Update copyright file for new version.
* Add Lena Voytek as an uploader.
* Update standards version and remove unnecessary fields.
* Remove libhiredis-dev dependency - no longer needed.
[ Luca Boccassi ]
* Use sysusers to manage the valkey system user and group.
-- Lena Voytek <[email protected]> Fri, 21 Aug 2026 18:00:08 -0400
valkey (8.1.4+dfsg1-2) unstable; urgency=medium
* Fix CVE-2025-67733 (Closes: #1130911).
A malicious user can use scripting commands to inject arbitrary
information into the response stream for the given client, potentially
corrupting or returning tampered data to other users on the same
connection. The error handling code for lua scripts does not properly
handle null characters.
- d/p/CVE-2025-67733.patch
* Fix CVE-2026-21863 (Closes: #1130911).
A malicious actor with access to the Valkey clusterbus port can send an
invalid packet that may cause an out bound read, which might result in
the system crashing. The Valkey clusterbus packet processing code does
not validate that a clusterbus ping extension packet is located within
buffer of the clusterbus packet before attempting to read it.
- d/p/CVE-2026-21863.patch
-- Lucas Kanashiro <[email protected]> Mon, 30 Mar 2026 18:47:11
-0300
valkey (8.1.4+dfsg1-1) unstable; urgency=medium
* New upstream release.
- Fixes CVE-2025-49844, CVE-2025-46817, CVE-2025-46818 and CVE-2025-46819
(Closes: #1117687)
* Update patches.
Remove d/p/CVE-2025-*.patch already applied by upstream
-- Lucas Kanashiro <[email protected]> Thu, 23 Oct 2025 21:30:33
-0300
valkey (8.1.1+dfsg1-3) unstable; urgency=medium
* Fix CVE-2025-32023 (Closes: #1108978)
An authenticated user may use a specially crafted string to trigger a
stack/heap out of bounds write on hyperloglog operations, potentially
leading to remote code execution. The bug likely affects all Valkey
versions with hyperloglog operations implemented.
An additional workaround to mitigate the problem without patching the
valkey-server executable is to prevent users from executing hyperloglog
operations. This can be done using ACL to restrict HLL commands.
- d/p/CVE-2025-32023.patch
* Fix CVE-2025-48367 (Closes: #1108982)
An unauthenticated connection can cause repeated IP protocol errors,
leading to client starvation and, ultimately, a denial of service.
- d/p/CVE-2025-48367.patch
* d/copyright: fix path of the lua files, thanks to lintian!
-- Lucas Kanashiro <[email protected]> Wed, 09 Jul 2025 05:53:22
-0300
### Old Ubuntu Delta ###
valkey (9.1.2-0ubuntu1) stonking; urgency=medium
* New upstream version 9.1.2 (LP: #2153491).
- Security fixes:
+ GHSA-jcj7-v34w-v9vv: Use-after-free in RDMA connection handling could
allow an authenticated client to crash the server using CLIENT KILL.
+ GHSA-fq2f-crmw-q97r: Unauthenticated use-after-free of the Lua
interpreter state via the script debugger command table.
- Bug fixes:
+ Fix double-free when a module timer callback stops its own timer.
+ Fix torn RESP3 push frames when publishing to a subscribed channel.
+ Always deep-validate listpacks on RDB load and RESTORE.
+ Fix crashes, hangs, and CPU spinning with RDMA and IO threads.
+ RESET now clears the CLIENT IMPORT-SOURCE flag.
+ Truncate partially written MULTI blocks from the AOF on short read.
+ Fix ACL bypass via duplicate STORE options in GEORADIUS.
+ Fix command log redaction leaking between MULTI commands and scripts.
+ Fix use-after-free when receiving a cluster message type from an
unloaded module.
+ Fix out-of-bounds access for cluster module message type 255.
+ AOF loading no longer performs ACL checks on replayed commands.
+ Fix mem_clients_normal leak on replicas after primary disconnects.
+ Fix client hang when a blocking command is pipelined with a partial
next command.
+ HGETEX now requires write permission on the key.
+ Compare the full TLS certificate CN during authentication.
+ Fix atomic slot migration with IO threads and TLS.
+ Reject invalid slot import ranges and job name lengths in RDB files.
+ MOVE and COPY now check ACL access to the current database.
+ Fix crash on COPY with a trailing DB option during slot migration.
+ Fix server panic when pipelined invalid-arity commands reach the key
prefetcher with IO threads.
+ HPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a
syntax error when the FIELDS keyword is missing.
+ Fix signed overflow crash with large hash field expiration times.
+ Fix frozen monotonic clock on hosts with unsynchronized TSC.
+ Fix stack overflow when retrying a failed TLS write of large replies.
+ Fix --check-system clocksource check on hosts using a hardware clock.
+ Fix IO threads assertion when a blocked client's pending command is
reprocessed before unblocking.
+ Sentinel no longer loads the Lua scripting engine at startup.
+ Validate cluster bus packet payload lengths to prevent remote crashes.
+ Harden stream validation on RDB load and RESTORE.
+ Reject stream payloads with mismatched live/deleted entry counts.
+ Restore IO threads throughput on socket and TLS connections.
+ Fix use-after-free when serving clients blocked on the same key.
+ Fix CLUSTER SLOT-STATS ORDERBY ordering past 2^31 counter diffs.
* Drop d/p/0006-support-openssl4-tls-tests.patch - fixed upstream.
-- Lena Voytek <[email protected]> Tue, 01 Sep 2026 16:47:57
-0400
valkey (9.1.1-0ubuntu2) stonking; urgency=medium
* d/t/control: Allow stderr in benchmark test, which may display a warning
about the constant_tsc flag not being present.
-- Lena Voytek <[email protected]> Wed, 26 Aug 2026 18:26:40
-0400
valkey (9.1.1-0ubuntu1) stonking; urgency=medium
* New upstream version 9.1.1.
* d/watch: Update to version 5, remove unnecessary repack suffix, and mangle
rc versions.
* d/copyright: Update for new version.
* d/control: Remove libhiredis-dev dependency - no longer needed.
* d/p/0005-Map-je_posix_memalign-for-system-jemalloc.patch: Map
je_posix_memalign to posix_memalign for system jemalloc.
* d/p/0006-support-openssl4-tls-tests.patch: Add support for OpenSSL 4 in
testsuite.
* d/p/0007-tests-ignore-constant_tsc-stderr.patch: Ignore TSC stderr notice
in testsuite due to lp builders.
* d/p/0004-Add-support-for-USE_SYSTEM_JEMALLOC-flag.patch: Refresh for new
version.
* d/rules: Skip tests incompatible with archive jemalloc and with bad
handshake.
-- Lena Voytek <[email protected]> Wed, 19 Aug 2026 17:04:57
-0400
valkey (9.0.4-0ubuntu2) stonking; urgency=medium
* No-change rebuild against libssl4
-- Ravi Kant Sharma <[email protected]> Fri, 24 Jul 2026
15:28:30 +0000
valkey (9.0.4-0ubuntu1) stonking; urgency=medium
* New upstream version 9.0.4 (LP: #2151296)
- Security fixes:
+ CVE-2026-23479: Use-After-Free in unblock client flow.
+ CVE-2026-25243: Invalid Memory Access in RESTORE command.
+ CVE-2026-23631: Use-after-free when full sync occurs during a yielding
Lua/function execution.
-- Lena Voytek <[email protected]> Wed, 06 May 2026 07:49:38
-0400
valkey (9.0.3-0ubuntu2) resolute; urgency=medium
* Drop external liblzf inclusion (LP: #2148320).
- d/rules: Remove external lzf linking.
- d/control: Remove liblzf-dev build dependency.
-- Lena Voytek <[email protected]> Tue, 14 Apr 2026 10:45:12
-0400
valkey (9.0.3-0ubuntu1) resolute; urgency=medium
* New upstream version 9.0.3 (LP: #2142590)
- Security fixes:
+ CVE-2025-67733: RESP Protocol Injection via Lua error_reply.
+ CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message.
+ CVE-2026-27623: Reset request type after handling empty requests.
- Bug fixes:
+ Avoid crash during MODULE UNLOAD when ACL rules reference a module
command and subcommand.
+ Fix server assert on ACL LOAD when current user loses permission to
channels.
+ Fix bug causing no response flush sometimes when IO threads are busy.
-- Lena Voytek <[email protected]> Tue, 24 Feb 2026 08:20:13
-0500
valkey (9.0.2-0ubuntu1) resolute; urgency=medium
* New major upstream version 9.0.2 (LP: #2138972)
- New features:
+ Add extended filtering for client commands.
+ Add multi-database support to cluster mode.
+ Add BYPOLYGON option for GEOSEARCH.
+ Introduce MPTCP support for primary and replica.
+ Add sentinel_total_tilt to sentinel INFO sentinel.
+ Add support for automatic client authentication via TLS certificate
fields.
+ Add --hotkeys-count option for valkey-cli.
+ Introduce atomic slot migration.
+ Add DELIFEQ command.
+ Add CLUSTER FLUSHSLOT command.
+ Allow dynamic modification of io-threads num.
+ Introduce HASH items expiration.
+ Add SAFE option to SHUTDOWN to reject shutdown in unsafe situations.
+ Add new cluster-announce-client-(port|tls-port) configs.
+ Implement a lolwut for version 9.
- Updates:
+ Add node pfail and fail count to cluster info metrics.
+ Introduce support for lttng based tracing.
+ Various performance optimizations including SIMD instructions,
pipelining,
hash tables, replication, and network operations.
+ Trigger manual failover on SIGTERM / shutdown to cluster primary.
+ Add cluster bus port out of range error message for CLUSTER MEET
command.
+ Add cluster-manual-failover-timeout to configure the timeout for manual
failover.
+ Allow replicas to become primaries without data by using CLUSTER
REPLICATE NO ONE.
+ Update reply schema for LMOVE and BLMOVE.
+ Make CONFIG RESETSTATS also reset cluster related stats.
+ Make CONFIG GET command return sorted output.
- Bug fixes:
+ Fix temp file leak during replication error handling.
+ Fix raxRemove crash at memcpy() due to key size exceeds max Rax size.
+ Fix error "SSL routines::bad length" when connTLSWrite is called second
time with smaller buffer.
+ Fix cmd's out bytes to count deferred reply.
+ Fix engine crash on module client blocking during keyspace events.
+ Fix invalidation messages being sent to closing clients.
+ Fix ACL LOAD crash on replica since the primary client doesn't have a
user.
+ Fix RANDOMKEY infinite loop during CLIENT PAUSE.
+ Fix panic in primary when blocking shutdown after previous block with
timeout.
+ Fix cluster slot stats assertion during promotion of replica.
+ Fix incorrect lag reported in XINFO GROUPS.
+ Fix crash during TLS handshake with I/O threads.
+ Fix random element selection in skewed sparse hash table.
+ Fix memory corruption in sharded pubsub unsubscribe.
+ Fix replica failover issues when config epoch is outdated.
+ Fix CLUSTER SLOTS/NODES showing wrong port after updating port/tls-
port.
+ Fix missing response when AUTH returns an error inside a transaction.
+ Fix memory leak with CLIENT LIST/KILL duplicate filters.
+ Fix replicas claiming to still have slots after manual failover.
+ Fix module context object re-use in scripting engines.
+ Fix defrag not stopping by defragging when slab 1/8 full.
+ Fix module key memory usage accounting.
+ Fix double MOVED reply on unblock at failover.
+ Fix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD.
+ Fix invalid memory address caused by hashtable shrinking during safe
iteration.
+ Fix Sentinel regression requiring "+failover" ACL in failover path.
+ Fix LTRIM to not call signalModifiedKey when no elements are removed.
+ Fix build on some 32-bit ARM by only using NEON on AArch64.
+ Fix deadlock in IO-thread shutdown during panic.
+ Fix CLUSTER SLOTS crash when called from module timer callback.
+ Respect process umask when creating data files.
+ Enable TCP_NODELAY by default in incoming and outgoing connections.
+ Ignore stale gossip packets that arrive out of order.
+ Remove unicode optimization in Lua cjson library.
+ Save config file and broadcast PONG message on configEpoch change.
+ Improve clarity of errors for GEO commands when member does not exist.
+ Allow mixing quoted and unquoted inline args.
+ Mark the client reprocessing flag only when unblocked on keys.
+ Prevent CLIENT UNBLOCK from unpausing paused clients.
+ Disallow sending REPLY ON / OFF / SKIP inside a multi-exec transaction.
+ Detect SSL_new() returning NULL in outgoing connections.
+ Correctly handle large cluster bus extensions which may have resulted
in dropped cluster packets.
+ Avoid shard id update of replica if it doesn't match with primary shard
id.
+ Redact user data when a module crashes for not handling I/O errors
enabled.
+ Generate a new shard_id when the replica executes CLUSTER RESET SOFT.
+ Reset io_last_written on c->buf resize to prevent stale pointers.
+ Avoid usage of light weight messages to nodes with not ready
bidirectional links in cluster.
+ Send duplicate multi meet packet only for node which supports it in
mixed clusters.
* d/p/0002-Add-CPPFLAGS-to-upstream-makefiles.patch: Refresh for new version.
* d/p/0004-Add-support-for-USE_SYSTEM_JEMALLOC-flag.patch: Match check for
USE_SYSTEM_JEMALLOC to that of USE_JEMALLOC.
* d/copyright: Update for new version and remove excluded files with fixed
license.
* d/rules: Skip maxmemory unit test during builds as it often times out.
* d/rules: Skip sentinel tests on armhf due to lack of memory.
-- Lena Voytek <[email protected]> Fri, 23 Jan 2026 17:14:04
-0500
valkey (8.1.4+dfsg1-0ubuntu1) resolute; urgency=medium
* New upstream version 8.1.4 (LP: #2127122)
- Security fixes:
+ CVE-2025-49844: Lua script may lead to remote code execution.
+ CVE-2025-46817: Lua script may lead to int overflow and potential RCE.
+ CVE-2025-46818: Lua script can be executed in context of another user.
+ CVE-2025-46819: LUA out-of-bound read
+ CVE-2025-49112: Integer underflow in setDeferredReply networking.c.
- Bug fixes:
+ Fix accounting for dual channel RDB bytes in replication stats.
+ Ensure empty error tables in scripts don't crash Valkey.
+ Fix use-after-free when active expiration triggers hashtable to shrink.
+ Fix memory usage to consider embedded keys.
+ Fix leak when shrinking a hashtable without entries.
+ Fix large allocations crashing Valkey during active defrag.
+ Prevent bad memory access when NOTOUCH client gets unblocked.
+ Converge shard-id persisted in nodes.conf to primary's shard id.
+ Fix client tracking memory overhead calculation.
+ Fix pre-size hashtables per slot when reading RDB files.
+ Don't use AVX2 instructions if the CPU don't support it.
+ Defrag if slab 1/8 full to fix defrag didn't stop issue.
* Remove patches fixed upstream:
- d/p/CVE-2025-49112.patch
- d/p/fix-8.1.x-multi-unit-test.patch
-- Lena Voytek <[email protected]> Sun, 12 Oct 2025 15:56:43
-0400
valkey (8.1.3+dfsg1-0ubuntu2) questing; urgency=medium
* Remove valkey-redis-compat package (LP: #2118952)
- d/control: Remove valkey-redis-compat entry.
- Remove valkey-redis-compat package files:
+ d/valkey-redis-compat.postinst
+ d/valkey-redis-compat.links
+ d/valkey-redis-compat.NEWS
- d/README.Debian: Remove migration readme entry.
- d/bin/generate-systemd-service-files: Remove condition that blocks
service start when REDIS_MIGRATION file exists.
- d/t/0006-migrate-from-redis: Remove redis migration test.
- d/NEWS: Add news entry to show valkey-redis-compat has been removed.
-- Lena Voytek <[email protected]> Tue, 12 Aug 2025 16:09:05
-0400
valkey (8.1.3+dfsg1-0ubuntu1) questing; urgency=medium
* New upstream version 8.1.3 (LP: #2115258)
- Security fixes:
+ CVE-2025-32023: Out-of-bounds write during hyperloglog operations.
+ CVE-2025-48367: IP Protocol errors resulting in DoS.
+ CVE-2025-27151: AOF file name length not checked.
- Bug fixes:
+ Fix missing response when AUTH is errored inside a transaction.
+ Properly escape double quotes and backslash in sdscatrepr.
+ Fix random element in skewed sparse hash table.
+ Only mark the client reprocessing flag when unblocked on keys.
+ Fix memory corruption in sharded pubsub unsubscribe.
+ Free module context even if there was no content written in auxsave2.
+ Detect SSL_new() returning NULL in outgoing connections.
+ Correctly cast the extension lengths.
+ Fix cluster myself CLUSTER SLOTS/NODES wrong port after updating
port/tls-port.
+ Fix replica can't finish failover when config epoch is outdated.
+ Fix CLIENT UNBLOCK ability to unpause paused clients.
* d/p/fix-8.1.x-multi-unit-test.patch: Fix multi unit test issue in new
version.
* d/p/0005-Incorporate-Redis-CVE-for-CVE-2025-27151-2146.patch: Remove- fixed
upstream in 8.1.2.
-- Lena Voytek <[email protected]> Mon, 07 Jul 2025 16:21:10
-0400
valkey (8.1.1+dfsg1-2ubuntu1) questing; urgency=medium
* Merge with Debian unstable (LP: #2110459). Remaining changes:
- Redis compatibility and migration:
+ d/bin/generate-systemd-service-files: do not start the services if
Redis migration happened.
+ d/control: add valkey-redis-compat binary package paragraph.
+ d/{README.Debian,valkey-redis-compat.NEWS}: document how the Redis.
migration works.
+ d/valkey-redis-compat.links: create compatibility symlinks for Redis.
+ d/valkey-redis-compat.postinst: migrate data and config from Redis.
+ d/tests: test Redis migration via DEP-8 test.
- d/tests: use systemctl instead of service to restart valkey.
- d/t/control: explicitly add Depends for each test.
- d/rules: remove "|| true" from testing calls.
* d/valkey-redis-compat.postinst: Do not migrate on upgrade if redis files
have already been migrated (LP: #2104217).
* d/rules: Skip memefficiency unit tests due to missing activedefrag
in system jemalloc.
-- Lena Voytek <[email protected]> Fri, 13 Jun 2025 13:04:10
-0400
** Affects: valkey (Ubuntu)
Importance: Wishlist
Status: New
** Tags: needs-merge upgrade-software-version
** Changed in: valkey (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: valkey (Ubuntu)
Milestone: None => ubuntu-27.02
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171162
Title:
Merge valkey 9.1.2-1 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/valkey/+bug/2171162/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
