Aggregator

valkey-9.1.2-1.fc45

Fedora Security Advisories
6 days 20 hours ago
FEDORA-2026-3e6f9d599a Packages in this update:
  • valkey-9.1.2-1.fc45
Update description: Valkey 9.1.2 - Released Mon 31 August 2026

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

Security Fixes
  • GHSA-jcj7-v34w-v9vv: Fix a use-after-free in RDMA connection handling that could allow an authenticated client to crash the server using CLIENT KILL. Only affects servers built with USE_RDMA and configured with an RDMA listener (#4534)
  • GHSA-fq2f-crmw-q97r: Fix an unauthenticated use-after-free of the Lua interpreter state, caused by a process-global script debugger command table that cached a raw pointer to a freed interpreter and was never invalidated (#4574)
Bug Fixes
  • Fix a double-free crash when a module timer callback stops its own timer with ValkeyModule_StopTimer by @quanyeyang (#4211)
  • Fix torn RESP3 push frames when a client publishes to a channel it is also subscribed to, which could desync client libraries by @quanyeyang (#4253)
  • Listpacks are now always validated on RDB load and RESTORE, preventing deferred assertion crashes; sanitize-dump-payload and its ACL flags become no-ops by @jjuleslasarte (#3721)
  • Fix crashes, hangs, and CPU spinning when the RDMA transport is used together with I/O threads by @quanyeyang (#3611)
  • RESET now clears the CLIENT IMPORT-SOURCE flag, so reused pooled connections return to normal expiration semantics by @tjade273 (#3973)
  • Truncate a partially written MULTI block from the AOF on short read, preventing loss of newer writes after a later restart by @chzhoo (#4342)
  • Fix an ACL bypass where duplicate STORE/STOREDIST options let GEORADIUS write or delete keys outside the user's permitted patterns by @tjade273 (#3971)
  • Fix command log redaction leaking between commands in a MULTI transaction and missing for commands executed from scripts by @madolson (#4323)
  • Fix a use-after-free crash when a module's cluster message type is received after the module is unloaded by @enjoy-binbin (#4360)
  • Fix out-of-bounds access for cluster module message type 255, which is now a valid, dispatchable message type by @enjoy-binbin (#4410)
  • AOF loading no longer performs ACL checks on replayed commands, preventing silent data loss when the default user is disabled by @lukepalmer (#3984)
  • Fix a client memory accounting leak on replicas that inflated the mem_clients_normal INFO field after primary disconnections by @enjoy-binbin (#4395)
  • Fix a permanent client deadlock when a blocking command like BLPOP is followed by a partially delivered pipelined command by @foobar (#4531)
  • HGETEX now requires write permission on the key, closing an ACL gap that let read-only users change field TTLs or delete fields by @ranshid (#4576)
  • Compare the whole TLS certificate CN during authentication, so an embedded NUL can no longer impersonate another ACL user by @madolson (#4577)
  • Fix atomic slot migration failures with I/O threads by not offloading the export job's writes while snapshotting by @satheeshaGowda (#4104)
  • Reject invalid slot import ranges when loading an RDB, so corrupted files can no longer create bad migration jobs by @enjoy-binbin (#4229)
  • Reject RDB slot import records with an invalid job name length, preventing an out-of-bounds read at startup by @quanyeyang (#4210)
  • MOVE and COPY now check ACL access to the current database, so users can no longer exfiltrate keys from an unauthorized DB by @cjx-zar (#4155)
  • Fix a crash on COPY with a trailing DB option during slot migration, and block cross-DB COPY regardless of option order by @madolson (#4301)
  • Fix a server panic when pipelined commands with invalid arity reach the key prefetcher with I/O threads enabled by @madolson (#4302)
  • HPERSIST, HTTL, HPTTL, HEXPIRETIME, and HPEXPIRETIME now return a syntax error when the FIELDS keyword is missing by @cjx-zar (#4300)
  • Fix a race between TLS I/O-thread writes and reads that could leave slot migration export jobs stuck until timeout by @jjuleslasarte (#4320)
  • Fix a signed overflow that let very large hash field expiration times (e.g. via HPEXPIREAT) crash the server by @ranshid (#4312)
  • Fix a frozen monotonic clock on hosts with unsynchronized TSC that stopped background tasks and key expiration by @quanyeyang (#4346)
  • Fix a stack overflow crash when retrying a failed TLS write with a large reply by @murphyjacob4 (#4307)
  • Fix the --check-system clocksource check to skip hosts using a hardware clock and suggest only actually available clocksources by @quanyeyang (#4272)
  • Fix an assertion failure with I/O threads when a blocked client's pending command was processed again before unblocking by @quanyeyang (#4376)
  • Sentinel no longer loads the built-in Lua scripting engine, removing a spurious warning at startup by @enjoy-binbin (#4327)
  • Validate channel, message, and module payload lengths in cluster bus packets, preventing forged packets from crashing nodes by @tjade273 (#3972)
  • Harden stream validation on RDB load and RESTORE so crafted payloads can no longer crash the server on later commands by @madolson (#3922)
  • Reject stream payloads with mismatched live/deleted record counts, preventing XDEL from destroying unaccounted entries by @roshkhatri (#4381)
  • Skip unnecessary post-read processing with I/O threads on socket and TLS connections, restoring small-payload throughput by @quanyeyang (#4401)
  • Fix a use-after-free crash when serving clients blocked on the same key if one client is freed during processing by @quanyeyang (#4212)
  • Avoid an unneeded client lookup per write completion with I/O threads on socket and TLS connections, improving pipelined throughput by @dgershko (#4440)
  • Fix CLUSTER SLOT-STATS ORDERBY returning wrong ordering when slot counters differ by more than 2^31 by @jzy1688 (#4459)
  • Fix slot migration failures with I/O threads and TLS by keeping the export job's ACK reads on the main thread while snapshotting by @satheeshaGowda (#4559)

USN-8705-2: OpenZFS vulnerability

Ubuntu Security Advisories
1 week ago
USN-8705-1 fixed vulnerabilities in OpenZFS. This update provides the corresponding fix for OpenZFS on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker could possibly use this issue to perform pool-administrative operations or access privileged information, resulting in an authorization bypass.

USN-8707-1: openCryptoki vulnerabilities

Ubuntu Security Advisories
1 week ago
It was discovered that primitive decoders in openCryptoki produced integer underflows when the encoded length was zero. An attacker could possibly use this issue to trigger out-of-bounds reads. (CVE-2026-40253) It was discovered that openCryptoki incorrectly handled symlinks. An attacker in the token-group could possibly use this issue to achieve privilege escalation or access sensitive information. (CVE-2026-23893) It was discovered that the CKM_ECDH_AES_KEY_WRAP implementation had a heap buffer overflow vulnerability. An attacker could possibly use this issue to trigger heap corruption, or denial-of-service. (CVE-2026-22791)

USN-8704-1: GNU cpio vulnerabilities

Ubuntu Security Advisories
1 week ago
It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the extraction directory, even when using the --no-absolute-filenames option. (CVE-2026-66484) It was discovered that cpio did not properly bound the stack memory allocated for pathnames during archive extraction. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to cause cpio to crash, resulting in a denial of service. (CVE-2026-66485) It was discovered that cpio did not properly escape archive member names when listing archive contents. If a user or automated system were tricked into listing a specially crafted archive, an attacker could possibly use this issue to inject misleading output or malicious terminal control sequences. (CVE-2026-66486)

USN-8705-1: OpenZFS vulnerability

Ubuntu Security Advisories
1 week ago
It was discovered that OpenZFS incorrectly handled authorization checks for certain ioctl operations on Linux. A local attacker could possibly use this issue to perform pool-administrative operations or access privileged information, resulting in an authorization bypass.

USN-8703-1: WebKitGTK vulnerabilities

Ubuntu Security Advisories
1 week ago
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

USN-8702-1: util-linux vulnerabilities

Ubuntu Security Advisories
1 week ago
It was discovered that libblkid in util-linux had a heap use-after-free vulnerability during nested partition probing. An attacker who could present a crafted block device image could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-13595) It was discovered that the mount utility in util-linux had a time-of-check- time-of-use vulnerability when setting up loop devices. A local attacker could possibly use this issue to obtain unauthorized read access to root- protected files and block devices. (CVE-2026-27456) It was discovered that the login utility in util-linux improperly canonicalized hostnames when invoked with the -h option. A remote attacker could possibly use this issue to bypass host-based access control rules. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-3184) It was discovered that libmount in util-linux had a time-of-check-time-of- use vulnerability in its ownership hook. A local attacker could possibly use this issue to gain elevated privileges. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53612) It was discovered that libmount in util-linux had a time-of-check-time-of- use vulnerability that allowed target path redirection during mount operations. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-53613) It was discovered that libmount in util-linux improperly handled the LIBMOUNT_FORCE_MOUNT2 environment variable in the SUID mount utility. A local attacker could possibly use this issue to bypass nosuid and noexec mount options and gain elevated privileges. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53614) It was discovered that libblkid in util-linux had an integer overflow vulnerability when parsing DOS partition tables. An attacker who could present a crafted block device image could possibly use this issue to cause a denial of service. (CVE-2026-53615)

USN-8701-1: UDisks vulnerability

Ubuntu Security Advisories
1 week ago
It was discovered that UDisks did not correctly validate the caller identity when handling the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. A local attacker with an active console session could possibly use this issue to mount filesystems on behalf of arbitrary users, including privileged accounts, leading to local privilege escalation.

USN-8678-3: OpenSSL vulnerability

Ubuntu Security Advisories
1 week ago
USN-8673-1 fixed vulnerabilities in OpenSSL. The update inadvertently left out the fix for CVE-2026-75803 in Ubuntu 26.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSSL incorrectly handled the QUIC server incoming channel queue. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14456) It was discovered that OpenSSL incorrectly handled signature algorithm selection when using Raw Public Keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14457) It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet processing. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-18798) It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874) It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. (CVE-2026-63072) It was discovered that OpenSSL incorrectly validated the sender distinguished name in CMP response messages. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63073) It was discovered that OpenSSL incorrectly limited the growth of an internal certificate cache used during CMP operations. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-63074) It was discovered that OpenSSL incorrectly handled QUIC ACK-only packet retention. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63075) It was discovered that OpenSSL incorrectly handled CMP protection algorithm validation. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2026-63076) It was discovered that OpenSSL incorrectly verified authentication tags when using certain AEAD ciphers via the EVP_Cipher() interface. An attacker could possibly use this issue to perform AEAD forgery attacks. (CVE-2026-75803)

USN-8700-1: MySQL vulnerabilities

Ubuntu Security Advisories
1 week ago
Multiple security issues were discovered in MySQL. MySQL has been updated to 8.4.11 in Ubuntu 26.04 LTS. Ubuntu 22.04 LTS and Ubuntu 24.04 LTS packages have been updated with backported patches. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-11.html https://www.oracle.com/security-alerts/cpujul2026.html