[SECURITY] [DSA 6538-1] redis security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6538-1 security@debian.org
https://www.debian.org/security/ Aron Xu
October 02, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : redis
CVE ID : CVE-2026-23479 CVE-2026-23631 CVE-2026-25243 CVE-2026-81934
Debian Bug : 1147421 1147422 1147423
Multiple vulnerabilities were discovered in Redis, a persistent key-value
database, which could result in denial of service or the execution of
arbitrary code.
This update also includes fixes for several related issues that have not
been assigned CVE identifiers: ACL key permission checks for SORT,
GEORADIUS, GEORADIUSBYMEMBER, XREAD and XREADGROUP could be bypassed; an
out-of-bounds read during ACL key extraction for KEYNUM commands invoked
with the wrong arity; missing validation of slot information when loading
RDB files; a use-after-free in the blocked client list; an out-of-bounds
read in HGETEX; and an integer overflow in the HyperLogLog hash function.
Additionally, CVE-2026-66373 addresses an incomplete fix for CVE-2026-25243.
Because that interim fix was never released on its own in Debian stable,
it is therefore not referenced in the CVE ID list above. This update
incorporates the comprehensive fix covering both issues.
For the stable distribution (trixie), these problems have been fixed in
version 5:8.0.2-3+deb13u3.
We recommend that you upgrade your redis packages.
For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmq/aPwACgkQ+GQ1dHE8
m66d+wf/WX5UH4LmD48N9IY4yUVs4DILJ0UeJfAjBKOwi6RoUHAC95UMLfVfuA89
bYzi5ebjYLEByyZ0qKyb67774wwh/4LXIragiChoTbOGu3N3D5F9oGeCymNxppuU
SjtdT40JMWohXaFv5/7LocbFpukh8fMk4nPJxAX++4rBvVGb7wKMtHisVSQ1Wj8s
yJIKuDgVSqmImcnMWnFXsu3MP/E3zzbXouEMD+eiPG3H9BZHWXGqzBhyqC/Xt+Vw
JrsStvYIbp9nZ8RxRV9KENAIQE7qADZfa6rsoN/YVq9+1Qc2n4FeTQVrQzShQWn4
9thTJi4F3BaKmWt5ywiiF18jwutc4A==
=t6Oi
-----END PGP SIGNATURE-----
Reply to: