Debian Patches

Status for redis/5:8.0.6-3

Patch Description Author Forwarded Bugs Origin Last update
debian-packaging/0001-Set-Debian-configuration-defaults.patch Set Debian configuration defaults Chris Lamb <lamby@debian.org> not-needed 2017-10-10
0001-Fix-FTBFS-on-kFreeBSD.patch Fix FTBFS on kFreeBSD Chris Lamb <lamby@debian.org> no 2015-10-30
0002-Add-CPPFLAGS-to-upstream-makefiles.patch Add CPPFLAGS and CXXFLAGS to upstream makefiles
.		 Chris Lamb <lamby@debian.org> no 2015-10-30
0003-Use-get_current_dir_name-over-PATHMAX.patch Use get_current_dir_name over PATHMAX, etc. Chris Lamb <lamby@debian.org> no 2018-01-24
0004-Add-support-for-USE_SYSTEM_JEMALLOC-flag.patch Add support for USE_SYSTEM_JEMALLOC flag. Chris Lamb <lamby@debian.org> yes 2025-05-09
0007-Add-Redis-ver.-REDIS_VERSION-to-LOLWUT-8-output-as-a.patch Add "Redis ver. $REDIS_VERSION" to LOLWUT 8 output as a some testsuites were relying on it.

eg. python-redis (https://github.com/redis/redis-py/blob/master/tests/test_commands.py#L1092)		 Chris Lamb <lamby@debian.org> yes 2025-07-14
0009-CVE-2026-21863.patch Fix for [CVE-2026-21863] Remote DoS with malformed Valkey Cluster bus message Roshan Khatri <rvkhatri@amazon.com> no 2026-02-23
debian-packaging/0002-Add-default-includes-for-configuration.patch Add pre & post includes in configuration redis.conf will now read files from a pre.d and post.d directory when
started. This enables avoiding configuration merge on package upgrade,
or diversion of the file.
===================================================================		 Julien Lecomte <julien@lecomte.at> not-needed 2025-03-12
0010-CVE-2026-23479.patch Fix use-after-free when evicting blocked client during unblock (CVE-2026-23479)

When re-executing a pending command after unblocking, check the return value
of `processCommandAndResetClient` and exit if needed.		 "debing.sun" <debing.sun@redis.com> no upstream, https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea.patch 2025-12-29
0011-CVE-2026-23631.patch Fix use-after-free when fullsync happens while replica is running a timed out script (CVE-2026-23631)

Fullsync triggers emptyData and scriptingReset which free the scripting/function engine. If a timed out script is still running on the replica, this causes a use-after-free. Delay fullsync processing in readSyncBulkPayload until the script finishes.		 Ozan Tezcan <ozantezcan@gmail.com> no upstream, https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb.patch 2026-04-14
0012-CVE-2026-25243.patch Invalid Memory Access in Redis RESTORE Command (CVE-2026-25243) Sergei Georgiev <s_ggeorgiev@yahoo.com> no upstream, https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02.patch 2025-11-27
0013-CVE-2026-66373.patch Reject corrupt stream RDB with shared NACK across consumers (#15081)

**Summary**

Detects and rejects corrupt stream RDB payloads where the same NACK
(pending entry) is referenced by more than one consumer, which violates
a stream data-structure.

**Changes**

- **`rdbLoadObject` (stream consumer PEL loading)**: Added a guard that
checks `nack->consumer != NULL` before assigning the consumer pointer.
When a second consumer's PEL references a NACK that was already claimed
by a prior consumer, the loader now reports a corrupt RDB error and
aborts instead of silently overwriting the pointer. Without this check,
two consumers share the same `streamNACK`, and freeing the first
consumer's PEL leaves the second with a dangling pointer.
- **`corrupt-dump.tcl`**: Added a regression test that crafts a stream
with two consumers (`consumerA`, `consumerB`) whose PELs both reference
the same entry (`1-0`). The `RESTORE` command is expected to fail with
`"Bad data format"`, and the server must remain responsive (`PING`
succeeds).

**Benefits**

- **Fail-fast on corrupt data**: The invariant violation is caught at
load time with a clear diagnostic message rather than manifesting as a
crash later during normal operation.
- **Regression coverage**: The crafted payload in the test ensures this
class of corruption is permanently guarded against.		 sggeorgiev <s_ggeorgiev@yahoo.com> no upstream, https://github.com/redis/redis/commit/4f62a8bf15c634187d8a87d874f8988032f90b6c.patch 2026-04-23
0014-CVE-2026-81934.patch Fix use-after-free in tlsProcessPendingData() pending-list iteration (#1391)

`tlsProcessPendingData()` iterates `pending_list` using a `listIter`, which pre-caches the `next` node pointer on every `listNext()` call. This cached pointer can dangle and be dereferenced after the node it points to has been freed, causing a use-after-free and a server crash (SIGSEGV).

The issue occurs because `tlsHandleEvent()` runs the connection's read handler, which can execute a command (e.g. `CLIENT KILL`) that closes a *different* pending TLS connection. That close path goes through `freeClient()` → `connClose()` → `connTLSClose()`, which calls `listDelNode()` and frees the victim connection's `pending_list` node. If the iterator's cached `next` pointer referenced that node, the following `listNext()` reads freed memory. The `listNext()` contract only permits removing the *current* node, not arbitrary other nodes.

Replace the `listIter`-based iteration with a detach-from-head, bounded drain so that no list node pointer is ever held across a handler call:

- Re-read `listFirst()` on each iteration instead of relying on a pre-cached `next` pointer
- Detach the head via `tlsPendingRemove()` *before* calling `tlsHandleEvent()`, so the loop always makes forward progress
- Semantics are preserved: in the common case each connection is handled exactly once per cycle, in order

(cherry picked from commit 98ff29b2828bf3245167b416ee23e6797f551a37)		 Sergei Georgiev <s_ggeorgiev@yahoo.com> no upstream, https://github.com/redis/redis/commit/6d088c335d5c3ec49a6c28486140b498e70b7834.patch 2026-06-09
0015-CVE-2026-92925.patch Reject cluster bus PING extensions with missing null terminator (#15263)

The cluster bus PING/PONG/MEET packet parser validated extension padding
and total length but never checked that string-carrying extensions are
properly null-terminated, allowing a crafted packet to trigger
out-of-bounds reads when the payload is later consumed as a C string.

1. **Null-termination check for hostname and human-nodename extensions
(`cluster_legacy.c`)**

Added a check inside the existing extension-validation loop in
`clusterProcessPacket`: for `CLUSTERMSG_EXT_TYPE_HOSTNAME` and
`CLUSTERMSG_EXT_TYPE_HUMAN_NODENAME` extension types, it verifies that
the data portion is non-empty (`datalen > 0`) and that the last byte is
`''`. Packets failing this check are rejected with a warning log and
an early return, the same way other malformed-extension cases are
handled.

2. **Test (`hostnames.tcl`)**

A new test exercises the rejection path by constructing a raw
cluster-bus PING packet with a 32-byte hostname extension that contains
no `''`, sending it directly to a node's bus port, and verifying the
packet is dropped (warning logged, hostname not updated in `CLUSTER
NODES`). Two helper procs (`build_cluster_bus_ping` and
`build_hostname_extension`) build the binary packet from scratch in Tcl,
allowing fine-grained control over extension contents without needing a
modified Redis sender.		 Sergei Georgiev <s_ggeorgiev@yahoo.com> no upstream, https://github.com/redis/redis/commit/37894faeea11e2db28b9fc2af378a762d2c36523.patch 2026-06-05

All known versions for source package 'redis'

Links