BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
DEBIAN SECURITY ADVISORYDEBIANVERIFIED

PUBLISHER UPDATE · DSA-6538-1

DSA-6538-1 release notes and known issues

DSA-6538-1 redis - security update

Scope: Debian. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

Multiple vulnerabilities were discovered in Redis, a persistent key-value database, which could result in denial of service or the execution of arbitrary code. This update also includes fixes for several related issues that have not been assigned CVE identifiers: ACL key permission checks for SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD and XREADGROUP could be bypassed; an out-of-bounds read during ACL key extraction for KEYNUM commands invoked with the wrong arity; missing validation of slot information when loading RDB files; a use-after-free in the blocked client list; an out-of-bounds read in HGETEX; and an integer overflow in the HyperLogLog hash function. Additionally, CVE-2026-66373 addresses an incomplete fix for CVE-2026-25243. Because that interim fix was never released on its own in Debian stable, it is therefore not referenced in the CVE ID list above. This update incorporates the comprehensive fix covering both issues. https://security-tracker.debian.org/tracker/DSA-6538-1

Improvements and security content

  • Multiple vulnerabilities were discovered in Redis, a persistent key-value database, which could result in denial of service or the execution of arbitrary code. This update also includes fixes for several related issues that have not been assigned CVE identifiers: ACL key permission checks for SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD and XREADGROUP could be bypassed; an out-of-bounds read during ACL key extraction for KEYNUM commands invoked with the wrong arity; missing validation of slot information when loading RDB files; a use-after-free in the blocked client list; an out-of-bounds read in HGETEX; and an integer overflow in the HyperLogLog hash function. Additionally, CVE-2026-66373 addresses an incomplete fix for CVE-2026-25243. Because that interim fix was never released on its own in Debian stable, it is therefore not referenced in the CVE ID list above. This update incorporates the comprehensive fix covering both issues. https://security-tracker.debian.org/tracker/DSA-6538-1

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Debian

Affected versions

  • See the official publisher source for applicability.

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Related vulnerabilities

BlackTree CVE Intelligence
CVE-2026-66373Open CVE report →CVE-2026-25243Open CVE report →

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Debian 12 BookwormOpen lifecycle record →

Official publisher evidence

DEBIANVERIFIED

DSA-6538-1 redis - security update

Checked 16 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source