UbuntuUpdates.org

Package "valkey-sentinel"

Name: valkey-sentinel

Description:

Persistent key-value database with network interface (monitoring)
Latest version: 9.0.4-0ubuntu0.2
Release: resolute (26.04)
Level: updates
Repository: main
Head package: valkey
Homepage: https://valkey.io

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "valkey-sentinel"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "valkey-sentinel" in Resolute

Repository Area Version
base main 9.0.3-0ubuntu2
security main 9.0.4-0ubuntu0.2

Changelog

Version: 9.0.4-0ubuntu0.2 2026-09-17 09:07:34 UTC

valkey (9.0.4-0ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-56684.patch: Fix use-after-free in
      tlsProcessPendingData() on CLIENT KILL (#4234) in src/tls.c.
    - debian/patches/CVE-2026-63639.patch: fix: Reject corrupt stream RDB with
      shared NACK across consumers (#4073) in src/rdb.c, tests/unit/dump.tcl.
    - CVE-2026-56684
    - CVE-2026-63639
  * SECURITY UPDATE: out-of-bound read
    - debian/patches/CVE-2026-85522.patch: Check and reject invalid slot import
      job names during RDB load (#4210) in src/cluster_migrateslots.c,
      src/valkey-check-rdb.c, tests/integration/rdb-slot-import.tcl.
    - CVE-2026-85522
  * debian/patches/fix-tests.patch: Repair backport validation failure in
    src/cluster_migrateslots.c, src/valkey-check-rdb.c.
  * debian/patches/fix-valkey-check-rdb-test.patch: Fix valkey-check-rdb test
    path

 -- Shishir Subedi Tue, 15 Sep 2026 11:20:23 +0545
Source diff to previous version
CVE-2026-56684 Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendin
CVE-2026-63639 Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream
CVE-2026-85522 A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file sr

Version: 9.0.4-0ubuntu0.1 2026-07-08 19:08:28 UTC

  valkey (9.0.4-0ubuntu0.1) resolute; urgency=medium

  * New upstream version 9.0.4 (LP: #2151296)
    - Security fixes:
      + CVE-2026-23479: Use-After-Free in unblock client flow.
      + CVE-2026-25243: Invalid Memory Access in RESTORE command.
      + CVE-2026-23631: Use-after-free when full sync occurs during a yielding
        Lua/function execution.

 -- Lena Voytek <email address hidden> Thu, 04 Jun 2026 09:35:02 -0400
2151296 Update Valkey to 7.2.13 in noble, 8.1.7 in questing, and 9.0.4 in resolute and stonking
CVE-2026-23479 Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `pro
CVE-2026-25243 Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values
CVE-2026-23631 Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-repl


About   -   Send Feedback to @ubuntu_updates