Package "valkey-sentinel"

valkey (9.0.6-0ubuntu0.1) resolute; urgency=medium

  * New upstream version 9.0.6 (LP: #2153491)
    - Security fixes:
      + CVE-2026-56684: Use-after-free in TLS connection handling via
        CLIENT KILL.
      + CVE-2026-63639: Reject corrupt stream RDB with shared NACK across
        consumers.
      + CVE-2026-85522: Reject RDB slot-import records with invalid job name
        length.
      + GHSA-jcj7-v34w-v9vv: Use-after-free in RDMA connection handling via
        CLIENT KILL.
    - Bug fixes:
      + Strictly validate CRLF terminators when parsing RESP requests.
      + Always deep-validate RDB and RESTORE payloads and reject crafted
        stream, zipmap, sorted set and slot import data.
      + Fix listpack corruption when XTRIM deletes the last entry of a node.
      + Fix ACL bypass in GEORADIUS with duplicate STORE options, require
        write permission for HGETEX and compare the full TLS certificate CN.
      + Fix use-after-free on ACL LOAD and skip ACL checks when loading AOF.
      + Discard incomplete MULTI blocks from truncated AOF files.
      + Fix malformed or torn replies from HPERSIST, RESP3 push frames and
        module deferred-length arrays.
      + Return syntax errors for hash field TTL commands missing FIELDS and
        return COMMAND INFO subcommands as an Array in RESP3.
      + Fix crashes, races and corrupted replies with IO threads and restore
        IO thread read and write performance on TCP and TLS.
      + Fix crashes with RDMA connections and IO threads.
      + Fix TLS crashes on pending data handling and large write retries.
      + Fix multiple crashes, hangs and protocol errors in atomic slot
        migration.
      + Fix use-after-free, double free and out-of-bounds issues in module
        timers, cluster message receivers and key LRU/LFU APIs.
      + Drop cached EVAL scripts when their scripting engine is unregistered.
      + Fix use-after-free and hang affecting blocked clients.
      + Fix crashes and infinite loops in hash field expiration.
      + Validate cluster bus payload lengths, AUX fields and announce IP.
      + Prevent replicas from processing stale cluster packets.
      + Fix cluster failover delay calculation, UPDATE logging and
        SLOT-STATS ordering.
      + Fix Sentinel crash during coordinated failover and reject control
        characters in SENTINEL SET.
      + Fix dual-channel replication announce IP and version handshake.
      + Fix replication log messages and negative sync transfer sizes.
      + Fix memory leaks in ZDIFF and GEOSEARCH and a fd leak on connect
        timeout.
      + Fix client memory accounting for output buffers, watched keys and
        replicas.
      + Clear CLIENT IMPORT-SOURCE state on RESET.
      + Fix database selection after module keyspace notifications.
      + Fix CONFIG REWRITE of large memory values and CONFIG SET of
        lua-enable-insecure-api.
      + Redact more user data from logs with hide-user-data-from-log.
      + Fix startup crash on 32-bit systems with 64-bit time_t and raise the
        maximum process title length.
      + Fix valkey-cli crash after --eval and improve --cluster del-node and
        --cluster fix.
  * Remove patches fixed upstream:
    - d/p/CVE-2026-56684.patch
    - d/p/CVE-2026-63639.patch
    [Fixed in 9.0.5]
    - d/p/CVE-2026-85522.patch
    - d/p/fix-tests.patch
    - d/p/fix-valkey-check-rdb-test.patch
    [Fixed in 9.0.6]

 -- Lena Voytek Tue, 13 Oct 2026 14:55:12 -0400

  valkey (9.0.4-0ubuntu0.1) resolute; urgency=medium

  * New upstream version 9.0.4 (LP: #2151296)
    - Security fixes:
      + CVE-2026-23479: Use-After-Free in unblock client flow.
      + CVE-2026-25243: Invalid Memory Access in RESTORE command.
      + CVE-2026-23631: Use-after-free when full sync occurs during a yielding
        Lua/function execution.

 -- Lena Voytek <email address hidden> Thu, 04 Jun 2026 09:35:02 -0400

  valkey (9.0.3-0ubuntu2) resolute; urgency=medium

  * Drop external liblzf inclusion (LP: #2148320).
    - d/rules: Remove external lzf linking.
    - d/control: Remove liblzf-dev build dependency.

 -- Lena Voytek <email address hidden> Tue, 14 Apr 2026 10:45:12 -0400