Typical security proofs of quantum key distribution (QKD) require that the emitted signals are independent and identically distributed. In practice, however, this assumption is not met because intrinsic device flaws inevitably introduce correlations between the emitted signals. Although analyses addressing this issue have been recently proposed, they only consider a restrictive scenario in which the correlations have a finite and known maximum length that is much smaller than the total number of emitted signals. While it is expected that the magnitude of the correlations decreases as the pulse separation increases, the assumption that this magnitude is exactly zero after a certain point does not seem to have any physical justification. Concerningly, this means that the available analyses cannot guarantee the security of current QKD implementations. Here, we solve this pressing problem by developing a rigorous framework that, when combined with existing results, can guarantee security against pulse correlations of unbounded length. Our framework is rather general and could be applied to other situations for which the existing analyses consider a scenario that differs slightly from the actual one.