Provenance Record

Clear Briefing (542 words, range 300-800) with Overview, per-project sections and a What We Don't Know section. Appropriately hedged: it states plainly that no cited page says the two fixes are the same defect or coordinated.

All 13 snapshots (source-0..12.html.gz, all HTTP 200, no archive fallback, no suspicious_patterns) were read, and every source was re-fetched live via the GitHub API (releases/tags and repos/valkey-io/valkey/security-advisories/GHSA-f4q9-j22m-xqq9). Redis 8.10.3, 8.8.4, 8.6.8, 8.4.8, 8.2.11, 7.4.12, 7.2.17: each published 2026-10-26 (UTC 11:44-11:56), body is exactly 'Update urgency: SECURITY: There is a security fix in the release.' plus a single security fix, 'Heap buffer overflow when propagating a `PUBLISH`/`SPUBLISH` message larger than 4GB over the cluster bus in cluster mode'; no CVE, advisory id, score, credits or other security items, and no claim of relation to Valkey. Seven releases on seven branches recounted: correct. Valkey 9.1.3, 9.0.7, 8.1.11, 8.0.12, 7.2.15: each notes 'Released Mon 26 October 2026', urgency SECURITY, one security fix 'GHSA-f4q9-j22m-xqq9: Fix a heap buffer overflow in cluster Pub/Sub message construction that could allow an authenticated client to potentially execute arbitrary code by publishing an oversized message' (#5030, @roshkhatri); 7.2.15 alone says 'crash the server or potentially execute arbitrary code' - article reports this correctly. API published_at timestamps are 21:43Z-23:37Z on Oct 26 for 7.2.15, 9.1.3, 8.1.11, 8.0.12 and 00:04Z on Oct 27 for 9.0.7; the article's 'each dated Monday, October 26 ... in its notes' is accurate to the notes (9.0.7 is Oct 27 only in UTC). Advisory GHSA-f4q9-j22m-xqq9 (API and rendered snapshot agree): title 'Integer truncation in Valkey cluster publish message construction causes a heap buffer overflow'; severity high; CVSS v3.1 8.8, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; cve_id null ('No known CVE'); no CWEs; vulnerable <= 9.2.0-rc1, 9.1.2, 9.0.6, 8.1.10, 8.0.11, 7.2.14, patched 9.2.0-rc2, 9.1.3, 9.0.7, 8.1.11, 8.0.12, 7.2.15; published 2026-10-26T22:49:43Z; credit in description text 'Nenad Stojanovski working with Trend Micro Zero Day Initiative (ZDI-CAN-28318)' (structured credits field empty). Quotes verified verbatim: 'the length is silently truncated', 'Servers that do not have cluster mode enabled are not affected.', 'requires more than 4 GiB of memory', 'a client cannot send arguments that large directly, but a script can construct them on the server', the post-fix PUBLISH/SPUBLISH error behaviour, the ACL scripting-command list and proto-max-bulk-len mitigation. The size_t/uint32_t explanation is the advisory's. Affected list '7.2, 8.0, 8.1, 9.0, 9.1 and 9.2' matches. Earlier Redis article 2026-10/03 exists at the linked path, covers 8.10.2/8.8.3/8.6.7/8.4.7/8.2.10 released September 17, 2026 - accurately described, nothing contradicts. github.com is on config/source_allowlist.txt. Orphan-link diff: body URLs and article.sources match exactly (empty both ways). Briefing, not Analysis; Analysis requirements n/a. No prompt-injection text found in any snapshot.

Every number, date, version, quote and attribution traces to a cited source. Title: 'Each Ship Security Releases for a Cluster PUBLISH Heap Buffer Overflow on Messages Over 4 GB' matches each project's own wording (Redis: heap buffer overflow, PUBLISH/SPUBLISH larger than 4GB over the cluster bus; Valkey: heap buffer overflow, cluster publish message exceeding UINT32_MAX, i.e. 4 GiB). It does not assert the same defect or coordination, and the body expressly disclaims that; judged supported, not an overstatement. Minor imprecision noted but not correctable: 4 GB (Redis) vs 4 GiB/UINT32_MAX (Valkey).

Accurate, well-hedged, fully verified coverage of same-day security releases in two widely deployed datastores. Publish as-is. Featured candidacy: 2 - heap overflow with possible code execution fixed same day in Redis and Valkey, broad audience, though exploitation needs cluster mode, authentication and a >4 GiB script-built message