[Git][security-tracker-team/security-tracker][master] Triage redis/valkey/redict issues
Aron Xu (@aron)
aron at debian.org
Wed Sep 30 04:43:10 BST 2026
Aron Xu pushed to branch master at Debian Security Tracker / security-tracker
Commits:
5a2e4352 by Aron Xu at 2026-09-30T11:41:02+08:00
Triage redis/valkey/redict issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -38679,13 +38679,19 @@ CVE-2026-82679 (A security flaw has been discovered in diem-project diem up to 5
CVE-2026-82678 (A vulnerability was identified in diem-project diem up to 5.1.3. The a ...)
NOT-FOR-US: diem-project diem
CVE-2026-82677 (A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is ...)
+ - redict <unfixed>
+ - redis <unfixed>
- valkey 9.1.2-1 (bug #1146641)
NOTE: https://github.com/valkey-io/valkey/issues/4200
NOTE: https://github.com/valkey-io/valkey/pull/4211
NOTE: Fixed by: https://github.com/valkey-io/valkey/commit/b349fe2821e3998534b1454c1b64a478daf8c6b7 (unstable)
NOTE: Fixed by: https://github.com/valkey-io/valkey/commit/9461cbaadcf92d090c409fb065ee25afde811221 (9.1.2)
NOTE: Fixed by: https://github.com/valkey-io/valkey/commit/345a057196edbd94f2f0be87d26a1299fcd95e60 (8.1.10)
- TODO: check redis, restic?
+ NOTE: redis shares this flaw and is unfixed upstream: moduleTimerHandler() removes and frees
+ NOTE: the timer after the callback returns, even when the callback already stopped it through
+ NOTE: RM_StopTimer(). Reproduced on redis 8.0.2 with a module whose timer callback stops
+ NOTE: its own timer: "free(): double free detected in tcache 2". The same unconditional
+ NOTE: free after the callback is present on the redis 7.2, 8.0 and unstable branches.
CVE-2026-82671 (A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulner ...)
NOT-FOR-US: IObit
CVE-2026-82670 (A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the ...)
@@ -38723,13 +38729,18 @@ CVE-2026-82659 (nodemailer before 9.0.1 fails to apply disableFileAccess and dis
[bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f
CVE-2026-82631 (A security flaw has been discovered in valkey-io valkey 9.1.0. The aff ...)
+ - redict <unfixed>
+ - redis <unfixed>
- valkey 9.1.2-1 (bug #1146641)
NOTE: https://github.com/valkey-io/valkey/issues/4198
NOTE: https://github.com/valkey-io/valkey/pull/4212
NOTE: Fixed by: https://github.com/valkey-io/valkey/commit/b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b (unstable)
NOTE: Fixed by: https://github.com/valkey-io/valkey/commit/e07a231cc607bffd39092efdd2c4344068557a9f (9.1.2)
NOTE: Fixed by: https://github.com/valkey-io/valkey/commit/f17a71df6ccd9a2476fd7534deb135593a8242bb (8.1.10)
- TODO: check resis and restic
+ NOTE: redis is affected by the same flaw and fixed it without a CVE id, by:
+ NOTE: https://github.com/redis/redis/commit/a8edcfc98c50bb01c850e5dab3998ce57807144d (#15594)
+ NOTE: The fix is present on the redis 7.2 and 8.2 branches but not on 7.0 or 8.0, so all
+ NOTE: redis versions in Debian are affected.
CVE-2026-82630 (A vulnerability was identified in PowerJob up to 5.1.2. Impacted is th ...)
NOT-FOR-US: PowerJob
CVE-2026-82629 (A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3 ...)
@@ -41514,6 +41525,7 @@ CVE-2026-81934 (Redis contains a use-after-free vulnerability in the 'tlsProcess
{DLA-4794-1}
- redis 5:8.0.6-3 (bug #1147423)
NOTE: https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834 (8.8.2)
+ NOTE: The same flaw in valkey is tracked in CVE-2026-56684
CVE-2026-81931 (Unrestricted Upload of File with Dangerous Type in the product photo u ...)
NOT-FOR-US: Roskus Prospero Flow CRM
CVE-2026-81851 (A heap-based buffer overflow vulnerability in Fireware OS's iked proce ...)
@@ -54650,12 +54662,14 @@ CVE-2026-63641 (MagicMirror\xb2 is an open source modular smart mirror platform.
CVE-2026-63640 (MagicMirror\xb2 is an open source modular smart mirror platform. Prior ...)
NOT-FOR-US: MagicMirror
CVE-2026-63639 (Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8 ...)
+ - redict <unfixed>
- valkey 9.1.1-1 (bug #1144957)
NOTE: https://github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4
NOTE: https://github.com/valkey-io/valkey/pull/4073
NOTE: Fixed by: https://github.com/valkey-io/valkey/commit/98465eaffe3f95524a5046318bfbc4bdb9798291 (8.1.9)
NOTE: Fixed by: https://github.com/valkey-io/valkey/commit/f8d2027e8d4df790ac04974bf606408c8ea62778 (8.0.10)
- TODO: check redis and redict
+ NOTE: The same flaw in redis is tracked in CVE-2026-66373, where redis is not-affected
+ NOTE: because the incomplete fix for CVE-2026-25243 was never applied
CVE-2026-63632 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
- onnx <unfixed> (bug #1145196)
[trixie] - onnx <no-dsa> (Minor issue)
@@ -54729,11 +54743,12 @@ CVE-2026-59781 (When Zabbix Agent was installed on Windows into a custom install
CVE-2026-57580 (authentik is an open-source identity provider. Prior to 2026.2.6 and 2 ...)
NOT-FOR-US: authentik
CVE-2026-56684 (Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8 ...)
+ - redict <unfixed>
- valkey 9.1.1-1 (bug #1144956)
NOTE: https://github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh
NOTE: https://github.com/valkey-io/valkey/pull/4234
NOTE: Fixed by: https://github.com/valkey-io/valkey/commit/33b14adf2026cfd8728607b026edb24843805844 (8.1.9)
- TODO: check redis and redict
+ NOTE: The same flaw in redis is tracked in CVE-2026-81934
CVE-2026-55839 (Kestra is an open-source, event-driven orchestration platform. Prior t ...)
NOT-FOR-US: Kestra
CVE-2026-55166 (Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated ...)
@@ -81967,6 +81982,8 @@ CVE-2026-66373 (Redis before 8.8.0, in the unusual case where an authenticated a
NOTE: Fixed by: https://github.com/redis/redis/commit/04292292f2f5c180322292007a599a700611ebaf (7.2.15)
NOTE: fixed by: https://github.com/redis/redis/commit/41a958720e64e03576dd652d224aa46d22c096c3 (6.2.23)
NOTE: Issue exists because of an incomplete fix for CVE-2026-25243.
+ NOTE: The same flaw in valkey is tracked in CVE-2026-63639, where valkey was affected and
+ NOTE: fixed it in 9.1.1-1
CVE-2026-66339 (A flaw was found in libsoup. After a CONNECT tunnel is established thr ...)
- libsoup3 <unfixed> (bug #1142846)
[trixie] - libsoup3 <no-dsa> (Minor issue)
@@ -146171,34 +146188,49 @@ CVE-2026-25589 (RedisBloom is a probabilistic data structures module for Redis.
CVE-2026-25588 (RedisTimeSeries is a time-series module for Redis. In all versions bef ...)
NOT-FOR-US: RedisTimeSeries Redis module
CVE-2026-25243 (Redis is an in-memory data structure store. In versions of redis-serve ...)
+ - redict <unfixed>
{DLA-4682-1}
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
[bullseye] - redis <not-affected> (Vulnerable code not present; checks for dups introduced later)
+ - valkey 9.1.1-1
NOTE: https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4
NOTE: https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive
NOTE: Fixed by: https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02 (8.6.3)
NOTE: When fixing this issue make the fix complete with the followups for CVE-2026-66373 to
NOTE: open up CVE-2026-66373.
- TODO: check redict and valkey
+ NOTE: valkey is affected as well, zipmapValidateIntegrity() lacks the overlong length-encoding
+ NOTE: check; ASan heap-buffer-overflow in zipmapDecodeLength() on 8.1.1+dfsg1-3+deb13u2.
+ NOTE: valkey fixed by: https://github.com/valkey-io/valkey/commit/fea0b4064cf612d1c365b032326832bff0946bd9 (8.1.7)
CVE-2026-23631 (Redis is an in-memory data structure store. In all versions of redis-s ...)
+ - redict <unfixed>
{DLA-4682-1}
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
[bullseye] - redis <ignored> (Invasive to backport entire timedOut mechanism etc.)
+ - valkey 9.1.1-1
NOTE: https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826
NOTE: https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica
NOTE: Fixed by: https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb (8.6.3)
- TODO: check redict and valkey
+ NOTE: valkey is affected as well, readSyncBulkPayload() has no isInsideYieldingLongCommand()
+ NOTE: guard; valkey 8.1.4 and earlier lack the fix.
+ NOTE: valkey fixed by: https://github.com/valkey-io/valkey/commit/c7c92db43b63be0599a076590f012ed35d279a47 (8.1.7)
+ NOTE: redict has the yielding-long-command mechanism but readSyncBulkPayload() lacks the guard
CVE-2026-23479 (Redis is an in-memory data structure store. In redis-server from 7.2.0 ...)
+ - redict <unfixed>
[experimental] - redis 5:8.6.3-1
- redis 5:8.0.6-3 (bug #1147421)
[bookworm] - redis <not-affected> (Vulnerable code not present)
[bullseye] - redis <not-affected> (Vulnerable code not present)
+ - valkey 9.1.1-1
NOTE: https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3
NOTE: https://www.zeroday.cloud/blog/redis-cve-2026-23479-deep-dive
NOTE: Fixed by: https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea (8.6.3)
- TODO: check redict and valkey
+ NOTE: valkey is affected as well, unblockClientOnKey() ignores the C_ERR return of
+ NOTE: processCommandAndResetClient(); reproduced under ASan on 8.1.1+dfsg1-3+deb13u2.
+ NOTE: valkey fixed by: https://github.com/valkey-io/valkey/commit/1d7224f3894c8e6db39a9e86c040270b3122c064 (8.1.7)
+ NOTE: redict 7.3.x is based on redis 7.2.4, so unlike bookworm/bullseye the reprocess-on-unblock
+ NOTE: path is present; unblockClientOnKey() calls processCommandAndResetClient() unchecked
CVE-2025-66369 (An issue was discovered in MM in Samsung Mobile Processor, Wearable Pr ...)
NOT-FOR-US: Samsung
CVE-2025-61669 (Jupyter Server is the backend for Jupyter web applications. In jupyter ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5a2e4352b5d939946d15a8a27e5e3841c89318d2
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5a2e4352b5d939946d15a8a27e5e3841c89318d2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/39761b24/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list