CLSA-2026-1788372462
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788372462.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788372462
- Upstream
- Published
- 2026-09-02T18:07:54Z
- Modified
- 2026-10-26T09:43:18Z
- Summary
- Fix CVE(s): CVE-2025-21605, CVE-2025-48367, CVE-2026-66373
- Details
-
- SECURITY UPDATE: Memory exhaustion via unauthenticated client output buffer
- debian/patches/0016-CVE-2025-21605.patch: cap the output buffer of unauthenticated clients in checkClientOutputBufferLimits() in src/networking.c, so a client that never reads its NOAUTH replies cannot grow the buffer without bound. Backport of upstream redis commit 5e93f9cb9 (6.2.18) as shipped by Debian for bullseye in 5:6.0.16-1+deb11u9 (DLA-4162-1), adapted to 5.0 by spelling the condition as server.requirepass && !c->authenticated, since 5.0 predates the ACL subsystem and has no authRequired() helper.
- CVE-2025-21605
- SECURITY UPDATE: Client starvation via repeated accept() errors
- debian/patches/0017-CVE-2025-48367.patch: add anetAcceptFailureNeedsRetry() to src/anet.c and retry the accept loop in acceptTcpHandler()/acceptUnixHandler() in src/networking.c and clusterAcceptHandler() in src/cluster.c, so a connection that fails at accept() time no longer aborts the whole batch and starves other pending clients. Backport of upstream redis commit 0fe674359 (6.2.19) as shipped by Debian for bullseye in 5:6.0.16-1+deb11u9 (DLA-4240-1); the acceptTLSHandler() hunk is dropped because 5.0 has no TLS support.
- CVE-2025-48367
- SECURITY UPDATE: Double free via stream RDB payload with a shared NACK
- debian/patches/0018-CVE-2026-66373.patch: reject a stream payload whose consumer PELs reference the same global-PEL NACK twice, in rdbLoadObject() in src/rdb.c, so RESTORE can no longer build two consumers sharing one streamNACK and have XGROUP DELCONSUMER free it twice. Backport of upstream redis commit 41a958720 (6.2.23) as shipped by Debian for bullseye and bookworm in 5:6.0.16-1+deb11u9 and 5:7.0.15-1~deb12u9 (DLA-4722-1), taken verbatim in the Debian form that uses rdbExitReportCorruptRDB(). Note this CVE exists because of an incomplete fix for CVE-2026-25243, which is a separate change and is not addressed here.
- CVE-2026-66373
- SECURITY UPDATE: Memory exhaustion via unauthenticated client output buffer
- References
Affected packages
TuxCare:Debian:10 / redis
Package
- Name
- redis
- Purl
- pkg:deb/tuxcare/redis?distro=debian-10
TuxCare:Debian:10 / redis-sentinel
Package
- Name
- redis-sentinel
- Purl
- pkg:deb/tuxcare/redis-sentinel?distro=debian-10
TuxCare:Debian:10 / redis-server
Package
- Name
- redis-server
- Purl
- pkg:deb/tuxcare/redis-server?distro=debian-10