Hi,

The following vulnerabilities were published for valkey.

CVE-2026-82631[0]:
| A security flaw has been discovered in valkey-io valkey 9.1.0. The
| affected element is the function handleClientsBlockedOnKey of the
| file src/blocked.c of the component Blocked-on-keys Subsystem. The
| manipulation results in use after free. The attack may be performed
| from remote. A high complexity level is associated with this attack.
| The exploitability is described as difficult. The exploit has been
| released to the public and may be used for attacks. The patch is
| identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a
| patch is advised to resolve this issue.


CVE-2026-82677[1]:
| A vulnerability was determined in valkey-io valkey 9.1.0. Impacted
| is the function moduleTimerHandler of the file src/module.c of the
| component Module Timer Subsystem. This manipulation causes double
| free. The attack can be initiated remotely. The exploit has been
| publicly disclosed and may be utilized. Patch name:
| b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is
| recommended to deploy a patch.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-82631
https://www.cve.org/CVERecord?id=CVE-2026-82631
[1] https://security-tracker.debian.org/tracker/CVE-2026-82677
https://www.cve.org/CVERecord?id=CVE-2026-82677

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
valkey, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146641@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Lena Voytek <lena@debian.org> (supplier of updated valkey package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 12 Sep 2026 22:36:42 -0400
Source: valkey
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 9.1.2-1
Distribution: unstable
Urgency: medium
Maintainer: Lucas Kanashiro <kanashiro@debian.org>
Changed-By: Lena Voytek <lena@debian.org>
Closes: 1146641 1146879 1147517
Changes:
 valkey (9.1.2-1) unstable; urgency=medium
 .
   * New upstream version 9.1.2 (Closes: #1146641, #1146879, #1147517).
     - Fix CVE-2026-82631, CVE-2026-82677, CVE-2026-85522, and CVE-2026-86227.
   * Remove 0006-Fix-test-cert-gen-and-tls-tests.patch - fixed upstream.
Checksums-Sha1:
 e92e3285066c438db99c850c802949379c3340e5 2251 valkey_9.1.2-1.dsc
 f9faa46df0782fe6237dd977b3074c5316df3558 4418246 valkey_9.1.2.orig.tar.gz
 d6c9e76f01c389d1d1188bc13581c05022a3d930 17752 valkey_9.1.2-1.debian.tar.xz
 8d715f036d8eb8d654520cdd1af81722a75e9dc4 8464 valkey_9.1.2-1_source.buildinfo
Checksums-Sha256:
 637995b2db343b75ae655fdb458b1f14f9b9b6f913f6144bdb9764b51b2ce2b2 2251 valkey_9.1.2-1.dsc
 8e8557da7426a51b4e0fb514a65ef6241dc7c85cb408243af389070abf379cec 4418246 valkey_9.1.2.orig.tar.gz
 e83701e1f5140721fe85cbe11bfdbf9b4bb841b6d423644977fbfd2ee417a629 17752 valkey_9.1.2-1.debian.tar.xz
 bb82088b64d672cfde1a4bf2c25bdf8ad0a544a53733bc69646c1e175336aede 8464 valkey_9.1.2-1_source.buildinfo
Files:
 78f2270d238ad42769b1e8ab06c68f02 2251 database optional valkey_9.1.2-1.dsc
 2f87e9ed4a98c093d85e2f90474498a7 4418246 database optional valkey_9.1.2.orig.tar.gz
 a641efebc34cb3f65c19782738c9f5eb 17752 database optional valkey_9.1.2-1.debian.tar.xz
 eb399451c70619dd7efa43e9b6b3b46f 8464 database optional valkey_9.1.2-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJEBAEBCgAuFiEEY+78PeFNUUbOfyS/NLitfZUp55MFAmqmEiEQHGxlbmFAZGVi
aWFuLm9yZwAKCRA0uK19lSnnk0glD/9zXNHyWCw+GsP61xKT+KSsW2Zvt0KEMH7N
fplzkIp505A0MU14Q8PWuytthe+kCe1QbsuxmNYAf+WWuY863W0RkK1qan55Go2/
YR53PE25ycIuoHDGI6ISDJJO0qy6AvcPtPAXf2iqnLt3ZlFx1+d/pK10oGh6x5hQ
jA3pJihYREolGk6Q2IMElQ85bXruvQYdxdAhN+OiZlktUYD4b1oPoNCK2tWJc3Jt
MnFqydMEAHnszL+q2SfPZ/U1TopmDpgafsEI9dFAk/fc1v/VY9WL3PoYRlVZAR4g
D3MPuf1d66lkdMrKqwr95kxx6sU/H0yNdJFBvHMbP+OOylJshDlHBb44dyYVcQyv
6ZWUSkh9mUA/1e/MaayO0M63V+vLsXEz+m+WnbCoNBc+Vv58snA4+G1iubG0GKRK
MnGp6uTt3RmfEv5BC2OiJsZqJsZ9d2VeTzv3htbQ0t5D1l5z1NKoMInmpuizeqie
Z3oCUuTKVbNKRo9HYxVgdB4omCRh9RgaO4w35TTYWNPA2tTrAEGRSe+yE5ysMeKQ
IOSol+vKEkvFv08ze3Ok5kSo6mC2d5cqRNPo3nv7I3UVyzxReSqJes9Ws7Znmymk
ytAEI85u9jLOnnSLpWDGoryDpSpkm/uhmKrNFFStDmOqNhRpqrWweLO8Nh/g2iaC
Zd0x20ETNg==
=TZ+V
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
valkey, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146641@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Lena Voytek <lena@debian.org> (supplier of updated valkey package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 24 Oct 2026 10:19:26 -0500
Source: valkey
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 8.1.1+dfsg1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Lucas Kanashiro <kanashiro@debian.org>
Changed-By: Lena Voytek <lena@debian.org>
Closes: 1144956 1144957 1146641
Changes:
 valkey (8.1.1+dfsg1-3+deb13u3) trixie-security; urgency=medium
 .
   * Fix CVE-2026-56684 (Closes: #1144956)
     Valkey's tlsProcessPendingData function iterates pending_list while an
     authenticated client can trigger CLIENT KILL, causing connTLSClose to
     delete the iterator's cached next node and producing a use-after-free that
     can crash the server or potentially allow remote code execution when TLS is
     enabled.
     - d/p/CVE-2026-56684.patch
   * Fix CVE-2026-63639 (Closes: #1144957)
     Valkey's RESTORE command accepts a malformed RDB stream payload that
     assigns one Pending Entry List NACK to multiple consumers during stream
     consumer-group deserialization, causing a use-after-free when one consumer
     is deleted while another still references the shared NACK and potentially
     allowing remote code execution.
     - d/p/CVE-2026-63639.patch
   * Fix CVE-2026-82631 and CVE-2026-82677 (Closes: #1146641)
     A server-side use-after-free can occur in handleClientsBlockedOnKey.
     - d/p/CVE-2026-82631.patch
     A server-side double free can occur in moduleTimerHandler.
     - d/p/CVE-2026-82677.patch
   * Fix CVE-2026-23479
     Valkey's unblockClientOnKey function re-executes a blocked client's
     pending command and then accesses the client without checking whether it
     was freed during processing, causing a use-after-free.
     - d/p/CVE-2026-23479.patch
   * Fix CVE-2026-23631
     Valkey frees the functions/scripting engine before loading the RDB during
     a replica full sync, which can happen while a Lua script is yielding via
     the long-command mechanism, causing a use-after-free when the script
     resumes.
     - d/p/CVE-2026-23631.patch
   * Fix CVE-2026-25243
     Valkey's zipmapValidateIntegrity function accepts overlong length
     encodings that zipmapNext later interprets differently, allowing a crafted
     RESTORE payload to cause a heap buffer over-read during zipmap to listpack
     conversion.
     - d/p/CVE-2026-25243.patch
Checksums-Sha1:
 3fdb869674f775b590e8444354210dbb843ee8c4 2271 valkey_8.1.1+dfsg1-3+deb13u3.dsc
 40f52feab50d74dc579abf6702429bbd080dce39 2726128 valkey_8.1.1+dfsg1.orig.tar.xz
 0ea6d03241018dfdef03dd0588504f9b3d26226a 37428 valkey_8.1.1+dfsg1-3+deb13u3.debian.tar.xz
 06132185cb9e8a10993ba3e6500083ecb568b1b2 8313 valkey_8.1.1+dfsg1-3+deb13u3_source.buildinfo
Checksums-Sha256:
 317246ffea280a14427d83f059a0696f1aef51247b30d7f1675f45849ea5d774 2271 valkey_8.1.1+dfsg1-3+deb13u3.dsc
 d9bbd82eecb82f359e649a0007ad3dc1b47cc15afa626348ca86b73c4ae2c7ee 2726128 valkey_8.1.1+dfsg1.orig.tar.xz
 d3c5f3bf8d880abd0aff543509d9226a8f2b64037cdfb165f597d45888bb0aea 37428 valkey_8.1.1+dfsg1-3+deb13u3.debian.tar.xz
 a5f255502c8f07732727bebc17ebed015b5bf365b016eb8769b1d6df29ae480f 8313 valkey_8.1.1+dfsg1-3+deb13u3_source.buildinfo
Files:
 c735994ea656b54880d416cd703ebdd8 2271 database optional valkey_8.1.1+dfsg1-3+deb13u3.dsc
 3ec2c18e27d75a0736caa812c2718c41 2726128 database optional valkey_8.1.1+dfsg1.orig.tar.xz
 a8ce68eb833eb06745cbdf3ddc362200 37428 database optional valkey_8.1.1+dfsg1-3+deb13u3.debian.tar.xz
 2f6adb91f754db88a05299efdbcc5a3f 8313 database optional valkey_8.1.1+dfsg1-3+deb13u3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJEBAEBCgAuFiEEY+78PeFNUUbOfyS/NLitfZUp55MFAmrfeT0QHGxlbmFAZGVi
aWFuLm9yZwAKCRA0uK19lSnnk2RfD/91CCNNEe0FVWVC9OTI9AXOEA63y8FJlu6v
htqs5Rr6aCeNTsIn+SOSTDnEFDqBJKGlRpRECaNuge031ASrlbNrE+UnxWZZweaY
RsEH4hcLS0SM9ZmoclAvdO59AC33E1VEEK81MsC5EQJQwtWfaNmwCI46rW5Xtz0P
472I2WmbcSJ+Np+qQtnU4UvelCXhVCVm4Da9jAbozXqSqGjey+LrZbb2ag8jfcHB
Qnx4zeq2XUb78Ps3Q604vF83ArGcg1sgNIFtMcbvIsCUDj1YeT2Z3PoJI7UcOtGp
HldgtnjVQ9koA3iUO4fYMWJuhtrbSeTw4V2+twyqbiyQGLyxrzSpRyzHhsMMwg17
hPk4GH84fD0h4RvJmZjCfS2kcP5AyhuH6qCzd6ZIheb9x9MHji9oH6KQryqXE9u8
yF24RZjYrf9LT4nGjMa3uFEKNAFh3uJoUbaLS3iaghrYd/rJ8ZhO33wt+TXLliKW
Qu3YZNul/iM2BLebIm/CigTJcNp6kQgGpDVucs5ctSoz5PmhzQXmG+AkZwSQvGg3
GV+Wq1Fi3Yis2hiFwU/iuxCDNLq5Pklc/PDb3tCvw/ZX2ip+OsCloxaqekT/APBk
XTbTdbJqismcTxVIeDq09ne36dAWTy8NyJGAvaNBDBCLToW6V9x18tGZ/FZqbx4/
euxMFQ4jvw==
=ht1c
-----END PGP SIGNATURE-----