Redis and its fork Valkey received a steady stream of security fixes in Debian during 2026. The latest are DSA-6586-1 for valkey (27 October), DSA-6538-1 for redis in Debian 13 (2 October) and DLA-4794-1 for redis in Debian 12 (24 September). Each update includes the earlier ones, so the practical question is simply whether you run the latest package.
At a glance
| Release | Package | Install at least | Latest advisory |
|---|---|---|---|
| Debian 13 (trixie) | redis | 5:8.0.2-3+deb13u3 | DSA-6538-1 (2 Oct 2026) |
| Debian 13 (trixie) | valkey | 8.1.1+dfsg1-3+deb13u3 | DSA-6586-1 (27 Oct 2026) |
| Debian 12 (bookworm) | redis | 5:7.0.15-1~deb12u10 | DLA-4794-1 (24 Sep 2026) |
Severity: High. Redis rates CVE-2026-25243 and CVE-2026-23479 high, and Valkey's CVE-2026-63639 carries CVSS 3.1 8.8. None of the CVEs below is in CISA's Known Exploited Vulnerabilities catalog (30 Oct 2026), although CISA's records note public proof-of-concept code for CVE-2026-81934 and CVE-2026-66373.
What the vulnerabilities are
The 2026 fixes fall into five areas. Most need a client that can already connect and run the command in question; in Redis and Valkey that includes anyone who can reach an instance without a password.
- RESTORE payloads. CVE-2026-25243 (Redis: high) lets a client allowed to run
RESTOREsupply a crafted serialized value that may lead to code execution. CVE-2026-66373 closes an incomplete fix for it (a double free), and CVE-2026-63639 is the matching Valkey bug. - Blocked clients and replication. CVE-2026-23479 is a use-after-free in the unblock-client flow (Redis 7.2 and later, so not the bookworm package). CVE-2026-23631 abuses master-replica synchronization on replicas where
replica-read-onlyis disabled; Debian notes that installations that prevent users from running Lua scripts were unaffected. - TLS. CVE-2026-81934 is a use-after-free in TLS pending-data handling; Debian's DLA says a remote, unauthenticated attacker may have been able to execute arbitrary commands. It applies only when TLS is enabled. CVE-2026-56684 is the Valkey equivalent.
- Cluster bus. CVE-2026-21863 and CVE-2026-92925 are out-of-bounds reads in cluster bus packet parsing that can crash a node. They matter only in cluster mode.
- Lua replies. CVE-2025-67733 lets a script inject CR/LF into an error reply and tamper with responses on the same connection (fixed in DSA-6198-1 for Valkey and DSA-6279-1 for Redis).
DSA-6538-1 also fixes several issues without CVE IDs, including ACL key-permission bypasses for SORT, GEORADIUS, XREAD and related commands. On Debian 13, the tracker still lists CVE-2026-92925 as open for redis with no DSA planned; cluster users should keep the cluster bus port on a private network.
Are you affected?
apt policy redis-server # Debian 12 and 13
apt policy valkey-server # Debian 13
sudo ss -ltnp | grep -E 'redis|valkey'If Installed is lower than the version in the table, you are missing at least one of these fixes. Also check whether TLS and cluster mode are on:
grep -E '^(tls-port|cluster-enabled|replica-read-only)' /etc/redis/redis.confFor Valkey the file is under /etc/valkey/.
How to update
sudo apt update
sudo apt install --only-upgrade redis-server redis-tools # Redis
sudo apt install --only-upgrade valkey-server valkey-tools # ValkeyA full sudo apt upgrade does the same along with your other pending updates. Debian 11 (bullseye) got its last Redis fix in August 2026 (DLA-4722-1); its LTS period ended on 31 August 2026, so later Redis fixes do not reach it.
Restart or reboot?
No reboot. Restart each instance so the new binary is running, during a quiet period if the data is not persisted:
sudo systemctl restart redis-server # or valkey-server, or redis-server@name
systemctl show -p ActiveEnterTimestamp redis-serverIn a replicated or clustered setup, restart replicas first, then fail over and restart the primary.
Limit what clients can do
Several of these bugs need specific commands. If your application does not use RESTORE or scripting, remove them from its ACL user, for example ACL SETUSER appuser -restore -@scripting, after checking that your libraries do not rely on them. Keep replicas read-only, keep the cluster bus port and the main port off the public internet, and require a password or ACL users on every instance.
Sources
- security-tracker.debian.org/tracker/DSA-6586-1
- debian.org/security/2026/dsa-6586
- security-tracker.debian.org/tracker/DSA-6538-1
- debian.org/security/2026/dsa-6538
- lists.debian.org/debian-security-announce/2026/msg00451.html
- security-tracker.debian.org/tracker/DLA-4794-1
- lists.debian.org/debian-lts-announce/2026/09/msg00029.html
- lists.debian.org/debian-lts-announce/2026/08/msg00012.html
- lists.debian.org/debian-lts-announce/2026/07/msg00024.html
- lists.debian.org/debian-security-announce/2026/msg00190.html
- lists.debian.org/debian-security-announce/2026/msg00107.html
- security-tracker.debian.org/tracker/source-package/redis
- github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4
- github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3
- github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826
- github.com/valkey-io/valkey/security/advisories/GHSA-mvcj-73cw-22m4
- github.com/valkey-io/valkey/security/advisories/GHSA-53mc-f3m3-99vh
- cve.org/CVERecord?id=CVE-2026-25243
- cve.org/CVERecord?id=CVE-2026-63639
- cve.org/CVERecord?id=CVE-2026-81934
- cve.org/CVERecord?id=CVE-2026-66373
- cve.org/CVERecord?id=CVE-2026-92925
- redis.io/docs/latest/operate/oss_and_stack/management/security/acl
- cisa.gov/known-exploited-vulnerabilities-catalog
- security-tracker.debian.org/tracker/DLA-4722-1
- security-tracker.debian.org/tracker/DLA-4682-1
- security-tracker.debian.org/tracker/DSA-6279-1
- security-tracker.debian.org/tracker/DSA-6198-1
- packages.debian.org/trixie/amd64/valkey-server/filelist
Comments
0 total · 0 threads