Redis 6.0.8 → 8.10.0
126 releases · 18 breaking changes · 230 security fixes · 6 advisories fixed
230security18breaking0deprecated184feature612fix
Vulnerabilities fixed by this upgrade
- 7.0 CVE-2024-31449 Lua library commands may lead to stack overflow and potential RCE
- 5.5 CVE-2024-31228 Denial-of-service due to unbounded pattern matching
- 3.1 CVE-2023-45145 Redis Unix-domain socket may be exposed with the wrong permissions for a short time window.
- 7.5 CVE-2021-32625 Vulnerability in STRALGO LCS
- 7.5 CVE-2021-29477 Vulnerability in the STRALGO LCS command
- high CVE-2021-21309 Integer overflow on 32-bit systems
Breaking changes
- breaking Query Engine - LeanVec and LVQ proprietary Intel optimizations were removed from Redis Open Source in 8.2.1
- breaking RM_ResetDataset module API should not clear the functions (#11268) in 7.0.6
- breaking RM_Call module API used with the "C" flag to run scripts, would now cause the commands in the script to check ACL with the designated user (#10966) in 7.0.6
- breaking Omitting a config option value in command line argument no longer works (#10660) in 7.0.1
- breaking Hide the may_replicate flag from the COMMAND command response (#10744) in 7.0.1
- breaking Protocol: Sharded pubsub publish emits smessage instead of message (#10792) in 7.0.1
- breaking CLUSTER SHARDS returns slots as RESP integers, not strings (#10683) in 7.0.1
- breaking Block PFCOUNT and PUBLISH in read-only scripts (*_RO commands, and no-writes) (#10744) in 7.0.1
- breaking Scripts that declare the no-writes flag are implicitly allow-oom too (#10699) in 7.0.1
- breaking Replicas panic when they fail writing persistence (#10504) in 7.0.0
- breaking Prevent cross slot operations in functions and scripts with shebang (#10615) in 7.0.0
- breaking Rephrased some error responses about invalid commands or args (#10612) in 7.0.0
- breaking Lua scripts do not have access to the print() function (#10651) in 7.0.0
- breaking Add argument specifying ACL reason for module log entry (#10559) Breaking API compatibility with 7.0 RCs in 7.0.0
- breaking Add the deprecated_since field in command args of COMMAND DOCS (#10545) Breaking API/ABI compatibility with 7.0 RCs in 7.0.0
- breaking LPOP/RPOP with count against non-existing list return null array (#10095) in 6.2.7
- breaking LPOP/RPOP used to produce wrong replies when count is 0 (#9692) in 6.2.7
- breaking Remove ACL subcommand validation if fully added command exists. (#8483) in 6.2.0
Security changes
- security Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode in 8.8.4
- security #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed in 8.8.3
- security #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new… in 8.8.3
- security TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload in 8.8.3
- security Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash in 8.8.3
- security (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write in 8.8.2
- security Out-of-bounds access in TopK heap cleanup path (MOD-15410) in 8.8.2
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 8.8.2
- security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 8.8.2
- security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 8.8.2
- security Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access in 8.8.2
- security Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running in 8.8.2
- security Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays in 8.8.2
- security TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user in 8.8.2
- security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 8.8.2
- security RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution in 8.8.1
- security Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode in 8.6.8
- security #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed in 8.6.7
- security #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new… in 8.6.7
- security TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload in 8.6.7
- security Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash in 8.6.7
- security (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write in 8.6.6
- security Out-of-bounds access in TopK heap cleanup path (MOD-15410) in 8.6.6
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 8.6.6
- security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 8.6.6
- security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 8.6.6
- security Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access in 8.6.6
- security Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running in 8.6.6
- security Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays in 8.6.6
- security TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user in 8.6.6
- security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 8.6.6
- security A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution in 8.6.5
- security RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution in 8.6.5
- security (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution in 8.6.3
- security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 8.6.3
- security (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution in 8.6.3
- security (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series) in 8.6.3
- security (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic) in 8.6.3
- security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 8.6.1
- security Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode in 8.4.8
- security #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed in 8.4.7
- security #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new… in 8.4.7
- security TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload in 8.4.7
- security Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash in 8.4.7
- security (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write in 8.4.6
- security Out-of-bounds access in TopK heap cleanup path (MOD-15410) in 8.4.6
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 8.4.6
- security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 8.4.6
- security #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity in 8.4.6
- security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 8.4.6
- security Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access in 8.4.6
- security Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running in 8.4.6
- security Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays in 8.4.6
- security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 8.4.6
- security A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution in 8.4.5
- security RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution in 8.4.5
- security (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. in 8.4.3
- security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 8.4.3
- security (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution in 8.4.3
- security (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series) in 8.4.3
- security (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic) in 8.4.3
- security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 8.4.2
- security RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log in 8.4.1
- security RedisBloom/RedisBloom#936 Cuckoo filter: crash on RDB load on 0 buckets (MOD-11593) in 8.4.1
- security RedisBloom/RedisBloom#945 Bloom filter: crash on RDB load on large number of filters (MOD-11590) in 8.4.1
- security Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode in 8.2.11
- security #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new… in 8.2.10
- security TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload in 8.2.10
- security Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash in 8.2.10
- security (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write in 8.2.9
- security Out-of-bounds access in TopK heap cleanup path (MOD-15410) in 8.2.9
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 8.2.9
- security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 8.2.9
- security #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity in 8.2.9
- security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 8.2.9
- security Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access in 8.2.9
- security Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running in 8.2.9
- security Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays in 8.2.9
- security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 8.2.9
- security A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution in 8.2.8
- security RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution in 8.2.8
- security (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. in 8.2.6
- security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 8.2.6
- security (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution in 8.2.6
- security (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series) in 8.2.6
- security (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic) in 8.2.6
- security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 8.2.5
- security RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log in 8.2.4
- security (CVE-2025-62507) XACKDEL - potential stack overflow and RCE in 8.2.3
- security (CVE-2025-49844) A Lua script may lead to remote code execution in 8.2.2
- security (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE in 8.2.2
- security (CVE-2025-46818) A Lua script can be executed in the context of another user in 8.2.2
- security (CVE-2025-46819) LUA out-of-bound read in 8.2.2
- security (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands in 8.2.0
- security (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error in 8.2.0
- security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 8.0.6
- security (CVE-2025-49844) A Lua script may lead to remote code execution in 8.0.4
- security (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE in 8.0.4
- security (CVE-2025-46818) A Lua script can be executed in the context of another user in 8.0.4
- security (CVE-2025-46819) LUA out-of-bound read in 8.0.4
- security (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands in 8.0.3
- security (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error in 8.0.3
- security (CVE-2025-27151) redis-check-aof may lead to stack overflow and potential RCE in 8.0.2
- security (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers in 8.0.0
- security Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode in 7.4.12
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 7.4.11
- security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 7.4.11
- security #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity in 7.4.11
- security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 7.4.11
- security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 7.4.11
- security A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution in 7.4.10
- security (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. in 7.4.9
- security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 7.4.9
- security (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution in 7.4.9
- security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 7.4.8
- security (CVE-2025-49844) A Lua script may lead to remote code execution in 7.4.6
- security (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE in 7.4.6
- security (CVE-2025-46818) A Lua script can be executed in the context of another user in 7.4.6
- security (CVE-2025-46819) LUA out-of-bound read in 7.4.6
- security (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands in 7.4.5
- security (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error in 7.4.5
- security (CVE-2025-27151) redis-check-aof may lead to stack overflow and potential RCE in 7.4.4
- security (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers in 7.4.3
- security (CVE-2024-46981) Lua script commands may lead to remote code execution in 7.4.2
- security (CVE-2024-51741) Denial-of-service due to malformed ACL selectors in 7.4.2
- security (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE in 7.4.1
- security (CVE-2024-31227) Potential Denial-of-service due to malformed ACL selectors in 7.4.1
- security (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching in 7.4.1
- security Fixes CVE-2024-31449: Lua library commands may lead to stack overflow and potential RCE in 7.4.0
- security Fixes CVE-2024-31228: Denial-of-service due to unbounded pattern matching in 7.4.0
- security Fixes CVE-2024-31227: Denial-of-service due to malformed ACL selectors in 7.4.0
- security Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode in 7.2.17
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 7.2.16
- security ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 7.2.16
- security Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity in 7.2.16
- security Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 7.2.16
- security A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution in 7.2.15
- security (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. in 7.2.14
- security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 7.2.14
- security (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution in 7.2.14
- security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 7.2.13
- security (CVE-2025-49844) A Lua script may lead to remote code execution in 7.2.11
- security (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE in 7.2.11
- security (CVE-2025-46818) A Lua script can be executed in the context of another user in 7.2.11
- security (CVE-2025-46819) LUA out-of-bound read in 7.2.11
- security (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands in 7.2.10
- security (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error in 7.2.10
- security (CVE-2025-27151) redis-check-aof may lead to stack overflow and potential RCE in 7.2.9
- security (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers in 7.2.8
- security (CVE-2024-46981) Lua script commands may lead to remote code execution in 7.2.7
- security (CVE-2024-51741) Denial-of-service due to malformed ACL selectors in 7.2.7
- security (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE in 7.2.6
- security (CVE-2024-31227) Potential Denial-of-service due to malformed ACL selectors in 7.2.6
- security (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching in 7.2.6
- security (CVE-2023-41056) In some cases, Redis may incorrectly handle resizing of memory buffers which can result in incorrect accounting of buffer sizes and lead to heap overflow and potential remote code execution. in 7.2.4
- security (CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup. in 7.2.2
- security (CVE-2023-41053) Redis does not correctly identify keys accessed by SORT_RO and, as a result, may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. in 7.2.1
- security Fixes CVE-2024-31449: Lua library commands may lead to stack overflow and potential RCE in 7.2.0
- security Fixes CVE-2024-31228: Denial-of-service due to unbounded pattern matching in 7.2.0
- security Fixes CVE-2023-45145: Redis Unix-domain socket may be exposed with the wrong permissions for a short time window. in 7.2.0
- security (CVE-2023-41056) In some cases, Redis may incorrectly handle resizing of memory buffers which can result in incorrect accounting of buffer sizes and lead to heap overflow and potential remote code execution. in 7.0.15
- security (CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup. in 7.0.14
- security (CVE-2023-41053) Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. in 7.0.13
- security (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and… in 7.0.12
- security (CVE-2023-36824) Extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Specifically: using COMMAND GETKEYS* and validation of key names in ACL rules. in 7.0.12
- security (CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access in 7.0.11
- security (CVE-2023-28425) Specially crafted MSETNX command can lead to assertion and denial-of-service in 7.0.10
- security (CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. in 7.0.9
- security (CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. in 7.0.9
- security (CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic in 7.0.8
- security (CVE-2023-22458) Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands can lead to denial-of-service in 7.0.8
- security (CVE-2022-35951) Executing a XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument, may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. The problem affects Redis versions 7.0.0 or newer [reported by… in 7.0.5
- security (CVE-2022-31144) A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. The problem affects Redis versions 7.0.0 or newer. in 7.0.4
- security Fixes CVE-2023-45145: Redis Unix-domain socket may be exposed with the wrong permissions for a short time window. in 7.0.0
- security (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. This issue affects all versions of Redis. [reported by Aviv Yahav]. in 7.0.0
- security (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. [reported by Aviv Yahav]. in 7.0.0
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 6.2.24
- security A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution in 6.2.23
- security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 6.2.22
- security (CVE-2025-49844) A Lua script may lead to remote code execution in 6.2.20
- security (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE in 6.2.20
- security (CVE-2025-46818) A Lua script can be executed in the context of another user in 6.2.20
- security (CVE-2025-46819) LUA out-of-bound read in 6.2.20
- security (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands in 6.2.19
- security (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error in 6.2.19
- security (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers in 6.2.18
- security (CVE-2024-46981) Lua script commands may lead to remote code execution in 6.2.17
- security (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE. in 6.2.16
- security (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching. in 6.2.16
- security (CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup. in 6.2.14
- security (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and… in 6.2.13
- security (CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access in 6.2.12
- security (CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. in 6.2.11
- security (CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. in 6.2.11
- security (CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic in 6.2.9
- security (CVE-2023-22458) Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands can lead to denial-of-service in 6.2.9
- security Sentinel: avoid logging auth-pass value (#9652) in 6.2.8
- security (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. This issue affects all versions of Redis. [reported by Aviv Yahav]. in 6.2.7
- security (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. [reported by Aviv Yahav]. in 6.2.7
- security (CVE-2021-41099) Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured to a non-default, very large value [reported by yiyuaner]. in 6.2.6
- security (CVE-2021-32762) Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms [reported by Microsoft Vulnerability Research]. in 6.2.6
- security (CVE-2021-32687) Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value [reported by Pawel Wieczorkiewicz, AWS]. in 6.2.6
- security (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections. in 6.2.6
- security (CVE-2021-32672) Random heap reading issue with Lua Debugger [reported by Meir Shpilraien]. in 6.2.6
- security (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value [reported by sundb]. in 6.2.6
- security (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for proto-max-bulk-len and client-query-buffer-limit [reported by sundb]. in 6.2.6
- security (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow [reported by Meir Shpilraien]. in 6.2.6
- security Fix integer overflow in BITFIELD on 32-bit versions (CVE-2021-32761). An integer overflow bug in Redis version 2.2 or newer can be exploited using the BITFIELD command to corrupt the heap and potentially result with remote code execution. in 6.2.5
- security Fix integer overflow in STRALGO LCS (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. in 6.2.4
- security Integer overflow in STRALGO LCS command (CVE-2021-29477): An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting… in 6.2.3
- security Integer overflow in COPY command for large intsets (CVE-2021-29478): An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result in remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a… in 6.2.3
- security Integer overflow on 32-bit systems (CVE-2021-21309): Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger… in 6.2.0
- security (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and… in 6.0.20
- security (CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access in 6.0.19
- security (CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. in 6.0.18
- security (CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. in 6.0.18
- security (CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic in 6.0.17
- security (CVE-2021-41099) Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured to a non-default, very large value [reported by yiyuaner]. in 6.0.16
- security (CVE-2021-32762) Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms [reported by Microsoft Vulnerability Research]. in 6.0.16
- security (CVE-2021-32687) Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value [reported by Pawel Wieczorkiewicz, AWS]. in 6.0.16
- security (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections. in 6.0.16
- security (CVE-2021-32672) Random heap reading issue with Lua Debugger [reported by Meir Shpilraien]. in 6.0.16
- security (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value [reported by sundb]. in 6.0.16
- security (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for proto-max-bulk-len and client-query-buffer-limit [reported by sundb]. in 6.0.16
- security (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow [reported by Meir Shpilraien]. in 6.0.16
- security Fix integer overflow in BITFIELD on 32-bit versions (CVE-2021-32761). An integer overflow bug in Redis version 2.2 or newer can be exploited using the BITFIELD command to corrupt the heap and potentially result with remote code execution. in 6.0.15
- security Fix integer overflow in STRALGO LCS (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. in 6.0.14
- security Integer overflow in STRALGO LCS command (CVE-2021-29477): An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting… in 6.0.13
- security Integer overflow in COPY command for large intsets (CVE-2021-29478): An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result in remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a… in 6.0.13
- security Integer overflow on 32-bit systems (CVE-2021-21309): Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger… in 6.0.11
Every release in between
featureCompact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
featureNew command: HIMPORT - high-throughput compact hash bulk insertion
otherTLS peer certificate-based server-to-server authentication
featureNew commands: LMOVEM, BLMOVEM - move multiple elements between lists
featureNew command: SUNIONCARD - get the cardinality of the union of multiple sets
featureNew command: SDIFFCARD - get the cardinality of the difference between sets
featureNew command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
featureXREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
featureNew command: FT.ALIASLIST - get all aliases for the index
featureStemmer support for Malay and Tagalog languages
otherJSONPath extensions
featureNew commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
featureNew command: TS.READ - optionally blocking read
featureNew command: TS.QUERYLABELS - Get a list of labels and label-values
featureNew command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
otherPerformance improvements
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
otherRocky Linux 8.10, 9.7, 10.1
otherAlmaLinux 8.10, 9.7, 10.1
otherDebian 12.13 (Bookworm), Debian 13.4 (Trixie)
otherAlpine 3.23
othermacOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM
fix#15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
fix#15453 Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
fix#15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed
fix#15518 notify modules when node's own ip/port changes
fix#15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
fixRediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)
fixRediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)
fixRediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)
fixRediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)
fixRediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)
fixRediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)
securityHeap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
security#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
security#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new…
securityTimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
securityVector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
security(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
securityOut-of-bounds access in TopK heap cleanup path (MOD-15410)
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
securityVector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
securityVector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
securityVector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
securityTLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityRedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
featureNew data structure: Array (@antirez)
otherSubkey notification for hash fields - field-level notifications
otherINCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)
featureXNACK: a new streams command - allow consumers to explicitly release pending messages
featureZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator
featureJSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays
otherTS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command
featureFT.HYBRID KNN clause: new argument to request fewer candidates per shard
featureFT.PROFILE HYBRID: profiling support for FT.HYBRID
otherPerformance improvements
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
otherRocky Linux 8.10, 9.7, 10.1
otherAlmaLinux 8.10, 9.7, 10.1
otherDebian 12.13 (Bookworm), Debian 13.4 (Trixie)
otherAlpine 3.23
othermacOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM
fix#15237 INCREX syntax update
fix#15005 Memory tracking can be enabled at runtime in non-clustered mode
fixRedisTimeSeries/RedisTimeSeries#1930 Cluster topology changes during a multi-shard command are not handled (MOD-14439)
fixRedisBloom/RedisBloom#1007 Memory leak on RDB load (MOD-15418)
securityHeap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
security#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
security#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new…
securityTimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
securityVector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
security(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
securityOut-of-bounds access in TopK heap cleanup path (MOD-15410)
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
securityVector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
securityVector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
securityVector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
securityTLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityA crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
securityRedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
fixRedisBloom/RedisBloom#1021 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover
fix#15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
fix#15163 MULTI queue memory incorrect memory accounting
fix#15115 Under-copy in the Lua debugger
fix#15094 Cluster crash when CLIENT KILL unsubscribes SSUBSCRIBE client inside EXEC
fix#14963 XREADGROUP: consumer replication inconsistency
fix#14934 Client output buffer memory tracking not accounting for copy-avoided bulk string references
fix#14970 Sentinel config injection via SENTINEL SET
fix#14982 SCAN commands: integer overflow in COUNT parameter
fix#15073 CLIENT TRACKING: self-overlap returning non-zero loop index
fix#15059 Use-after-free
fix#15037 XINFO STREAM: wrong value in the per-slot memory tracking
fix#15034, #15081 Issues processing corrupt RDB data
fix#15021 HEXPIRE: overflow on fields count
fix#14942 Fix COMMAND GETKEYS for PFMERGE with no source keys
fix#15188 cluster-announce-ip rejecting hostnames (regression)
fix#14667, #14886 Potential TCP stalls/deadlocks
fixRediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
fixRediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)
security(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution
security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
security(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
security(CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
security(CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)
fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
fixCONFIG SET: some settings allow invalid characters (RED-167787)
fixSCRIPT DEBUG: potential crash on scripts (RED-175507)
fixVADD: crash or buffer overflow on large REDUCE value (RED-170921)
fixVSET: crash on huge allocations (MOD-12678)
fixPotential crash on disconnections and TLS failures (Time Series) (MOD-14850)
fixRediSearch/RediSearch#8745 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
fixRediSearch/RediSearch#8848 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
fixRediSearch/RediSearch#8205, RediSearch/RediSearch#8259 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-12370, MOD-13884)
fixRediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty reply (MOD-14778)
fixRediSearch/RediSearch#8129, RediSearch/RediSearch#8140 FT.PROFILE reports an incorrect shard total profile time (MOD-13735, MOD-13181)
fixRediSearch/RediSearch#9047 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
fixRediSearch/RediSearch#8791 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
fixRediSearch/RediSearch#8382 Crash when indexing negative zero (-0.0) (MOD-13904)
fixRediSearch/RediSearch#8590 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
fixRediSearch/RediSearch#8660 FILTER behavior depends on property order in the expression (MOD-14065)
fixRediSearch/RediSearch#8593 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
fixRediSearch/RediSearch#8591 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
fixRediSearch/RediSearch#8589 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14328)
fixRediSearch/RediSearch#9012 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
fixRediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
fixRediSearch/RediSearch#8462 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
fixRediSearch/RediSearch#9066 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)
fixRediSearch/RediSearch#8109, RediSearch/RediSearch#8149 Configuration registration omits module parameters, causing them to be unexposed or misapplied (RED-171841)
fixRediSearch/RediSearch#9163 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
fixRediSearch/RediSearch#8395 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828)
fixRediSearch/RediSearch#8451 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14079)
fixRediSearch/RediSearch#9078 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)
fixRediSearch/RediSearch#8051, RediSearch/RediSearch#8114 Crash diagnostics now include the IndexSpec of the index the failing thread was working on (MOD-7574)
featureRediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)
fix#14824 Potential UAF: don't use reply copy avoidance for module strings
fix#14848 Crash during command processing on replicas performing full synchronization
fix#14794 New XIDMPRECORD internal command and AOFRW emission to restore stream IDMP state
fix#14816 setModuleEnumConfig() passing prefixed name to module callbacks
fix#14858 Streams: Ensures XADD with IDMP/IDMPAUTO that hits an existing IID records the metadata change
fix#14855, #14831, #14817 Potential memory leaks
fix#14869 Streams: IDMP cron expiration not working after RDB load
fix#14847 Potential crash during ACL checks on wrong-arity commands
fix#14883 HSETEX, HGETEX do not validate that FIELDS is specified only once
fix#14897 Streams: IDMP-related bugs
securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
fix#14785 HOTKEYS: The INFO command may display module information, and the missing HOTKEYS HELP subcommand has been added
fix#14789 Bug in RDB loading prevented hash table expansion, increasing load time
otherSubstantial performance improvements
otherSubstantial memory reduction for hashes (hashtable-encoded) and sorted sets (skiplist-encoded)
featureStreams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments
featureNew eviction policies - least recently modified: volatile-lrm and allkeys-lrm
featureHot keys detection and reporting; new command: HOTKEYS
otherTLS certificate-based automatic client authentication
featureTime series: support NaN values; new aggregators: COUNTNAN and COUNTALL
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)
otherRocky Linux 8.10, 9.5
otherAlmaLinux 8.10, 9.5, 10.1
otherDebian 12 (Bookworm), Debian 13 (Trixie)
othermacOS 14 (Sonoma), 15 (Sequoia)
feature#14695 Keys memory size histograms
feature#14714 Optimize user ACL permission verification
feature#14692 Optimize peak memory metric collection
feature#14739 Avoid allocating and releasing list node in reply copy avoidance
feature#14713 Reduce per command syscalls by reusing cached time when hardware monotonic clock is available
feature#14726 Optimize XREADGROUP CLAIM
feature#13962 Vector set: replace manual popcount with __builtin_popcountll for binary vector distance (Intel, AMD, ARM)
feature#14474 Vector set: vectorized the quantized 8-bit vector distance calculation (Intel, AMD)
feature#14492 Vector set: vectorize binary quantization path for vectorsets distance calculation (Intel, AMD)
other#14719 cluster-slot-stats-enabled - per-slot resource consumptions statistics to collect
other#14695 key-memory-histograms collect memory consumption histograms per data type
other#14695 db0_distrib_lists_sizes, db0_distrib_sets_sizes, db0_distrib_hashes_sizes, db0_distrib_zsets_sizes
fixStreams: avoid using XADD with the new IDMP or IDMPAUTO options when using appendonly yes with aof-use-rdb-preamble no (non default). This limitation will be removed in the next patch.
securityHeap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
security#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
security#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new…
securityTimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
securityVector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
security(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
securityOut-of-bounds access in TopK heap cleanup path (MOD-15410)
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
security#14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
securityVector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
securityVector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
securityVector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityA crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
securityRedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
fixRedisBloom/RedisBloom#1020 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover
fix#15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
fix#15163 MULTI queue memory incorrect memory accounting
fix#14581 Rare server hang at shutdown
fix#14545 ACL: AOF loading fails if ACL rules are changed and don't allow some commands in MULTI-EXEC
fix#14537 SCAN: restore original filter order (revert change introduced in 8.2)
fix#14816 setModuleEnumConfig() passing prefixed name to module callbacks
fix#14659 ACL: Key-pattern bypass in MSETEX
fix#14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies
fix#14552 Streams: Incorrect behavior when using XDELEX ... ACKED after XGROUP DESTROY
fix#14848 Crash during command processing on replicas performing full synchronization
fix#15188 cluster-announce-ip rejecting hostnames (regression)
fix#14667, #14886 Potential TCP stalls/deadlocks
fixRediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
fixRediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)
security(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
security(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
security(CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
security(CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)
fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
fixCONFIG SET: some settings allow invalid characters (RED-167787)
fixSCRIPT DEBUG: potential crash on scripts (RED-175507)
fixVADD: crash or buffer overflow on large REDUCE value (RED-170921)
fixVSET: crash on huge allocations (MOD-12678)
fixPotential crash on disconnections and TLS failures (Time Series) (MOD-14850)
fixRediSearch/RediSearch#8744 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
fixRediSearch/RediSearch#8849 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
fixRediSearch/RediSearch#8258 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-13885)
fixRediSearch/RediSearch#9183 FT.PROFILE HYBRID returns an empty reply (MOD-14778)
fixRediSearch/RediSearch#9048 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
fixRediSearch/RediSearch#8792 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
fixRediSearch/RediSearch#8384 Crash when indexing negative zero (-0.0) (MOD-13904)
fixRediSearch/RediSearch#8596 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
fixRediSearch/RediSearch#8661 FILTER behavior depends on property order in the expression (MOD-14065)
fixRediSearch/RediSearch#8598 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
fixRediSearch/RediSearch#8597 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
fixRediSearch/RediSearch#8595 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14062)
fixRediSearch/RediSearch#9011 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
fixRediSearch/RediSearch#9080 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
fixRediSearch/RediSearch#8461 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
fixRediSearch/RediSearch#9091 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)
fixRediSearch/RediSearch#9161 Coordinator deadlock under mixed FT.SEARCH and FT.AGGREGATE load (MOD-14268)
fixRediSearch/RediSearch#9165 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
fixRediSearch/RediSearch#8394 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828)
fixRediSearch/RediSearch#8452 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14080)
fixRediSearch/RediSearch#9077 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)
featureRediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)
securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
securityRedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log
securityRedisBloom/RedisBloom#936 Cuckoo filter: crash on RDB load on 0 buckets (MOD-11593)
securityRedisBloom/RedisBloom#945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)
fix#14637 Atomic slot migration: wrong adjacent slot range behavior
fix#14567 Atomic slot migration: support delay trimming slots after finishing migrating slots
fix#14746 CLUSTER SLOT-STATS: Fix few memory tracking bugs
fixRedisTimeSeries/RedisTimeSeries#1864 Atomic slot migration: time series limitations (MOD-13611)
fixRediSearch/RediSearch#6973 Correct empty string token counting in byteOffset calculations to ensure accurate text position tracking (MOD-11233)
fixRediSearch/RediSearch#6995 Prevent FT.INFO command fanout to replicas to reduce unnecessary cluster traffic
fixRediSearch/RediSearch#7154 Display Background Indexing OOM warning in FT.AGGREGATE when memory limits are approached (MOD-11817)
fixRediSearch/RediSearch#7219 Resolve concurrency issue in FT.AGGREGATEreducer that caused intermittent errors (MOD-12243)
fixRediSearch/RediSearch#7255 Correct BM25STD underflow wraparound to prevent incorrect scoring (MOD-12223)
fixRediSearch/RediSearch#7264 Ensure accurate totalDocsLen updates to maintain correct document statistics (MOD-12234)
fixRediSearch/RediSearch#7275 Report used memory as unsigned long to prevent overflow (RED-169833)
fixRediSearch/RediSearch#7350 FT.CREATE with LeanVec parameters on non-Intel architectures (RED-176382)
fixRediSearch/RediSearch#7371 Validate search-min-operation-workers min value correctly (MOD-12383)
fixRediSearch/RediSearch#7430 Prevent coordinator deadlock in FT.HYBRID queries by avoiding index read lock (MOD-12489)
fixRediSearch/RediSearch#7435 Ensure full profile output on timeout with RETURN policy in FT.PROFILE (MOD-12320)
featureRediSearch/RediSearch#7496 Vector search performance improvements (MOD-12011, MOD-12063, MOD-12629, MOD-12346)
featureRediSearch/RediSearch#7519 Reduce number of worker threads asynchronously to improve resource utilization (MOD-12252, MOD-11658)
featureRediSearch/RediSearch#7694 Use asynchronous jobs in GC for SVS to reduce blocking (MOD-12668)
featureRediSearch/RediSearch#7730 Support filter_policy and batch_size parameters for vector similarity search tuning (MOD-13007, MOD-12371)
featureRediSearch/RediSearch#7782 Resolve SVS GC failures when worker threads are disabled (MOD-12983)
featureRediSearch/RediSearch#7572 Implement ASM state machine on notifications (MOD-12170)
featureRediSearch/RediSearch#7829 ASM-aware search flow for Active-Active deployments (MOD-12171, MOD-12169)
featureRediSearch/RediSearch#7589 Support multiple slot ranges in search.CLUSTERSET for flexible cluster topology updates (MOD-11657)
featureRediSearch/RediSearch#7862 Support subquery count in FT.HYBRID (MOD-11858, MOD-13146)
featureRediSearch/RediSearch#7893 Request policy support for cursor operations (MOD-13146, MOD-9573, MOD-8104)
featureRediSearch/RediSearch#8087 Warning when cursor may give inaccurate results due to Active-Active replication (MOD-12899)
featureRediSearch/RediSearch#7445 Remove outdated validation from Debug Aggregate in cluster mode (MOD-12435)
featureRediSearch/RediSearch#7384 Reduce index load from RDB temporary memory overhead (MOD-12212)
featureRediSearch/RediSearch#7573 Debug support for FT.PROFILE command (MOD-12627)
featureRediSearch/RediSearch#7736 Add Internal cursor reads metric to cluster FT.PROFILE output (MOD-12414)
featureRediSearch/RediSearch#7552 Add active_io_threads metric (MOD-12069, MOD-12695)
featureRediSearch/RediSearch#7622 Add active_coord_threads metric (MOD-12694, MOD-12069)
featureRediSearch/RediSearch#7564 Add active_worker_threads metric (MOD-12694, MOD-12069)
featureRediSearch/RediSearch#7626 Add *_pending_jobs metrics for job queues (MOD-12069)
featureRediSearch/RediSearch#7658 Add pending workers admin jobs metric (MOD-12069, MOD-12791)
featureRediSearch/RediSearch#7731 Add active_topology_update_threads metric (MOD-12069, MOD-12790)
featureRediSearch/RediSearch#7083 Add default scorer configuration option (MOD-10037)
+44 more items in the release notesotherDIGEST, DELEX; SET extensions - atomic compare-and-set and compare-and-delete for string keys
otherMSETEX - atomically set multiple string keys and update their expiration
featureXREADGROUP - new CLAIM option for reading both idle pending and incoming stream entries
otherCLUSTER MIGRATION - atomic slot migration
otherCLUSTER SLOT-STATS - per-slot usage metrics: key count, CPU time, and network I/O
otherRedis query engine: FT.HYBRID - hybrid search and fused scoring
otherRedis query engine: I/O threading with performance boost for search and query commands (FT.*)
otherI/O threading: substantial throughput increase (e.g. >30% for caching use cases (10% SET, 90% GET), 4 cores)
otherJSON: substantial memory reduction for homogenous arrays (up to 92%)
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)
otherRocky Linux 8.10, 9.5
otherAlmaLinux 8.10, 9.5
otherDebian 12 (Bookworm), Debian 13 (Trixie)
othermacOS 13 (Ventura), 14 (Sonoma), 15 (Sequoia)
fix#14524 XREADGROUP CLAIM returns strings instead of integers
fix#14529 Add variable key-spec flags to SET IF* and DELEX
fix#P928 Potential memory leak (MOD-11484)
fix#T1801, #T1805 macOS build failures (MOD-12293)
fix#J1438 JSON.NUMINCRBY - wrong result on integer array with non-integer increment (MOD-12282)
fix#J1437 Thread safety issue related to ASM and shared strings (MOD-12013)
feature#14480, #14516 Optimize XREADGROUP
fixWhen executing FT.SEARCH, FT.AGGREGATE, FT.CURSOR, FT.HYBRID, TS.MGET, TS.MRANGE, TS.MREVRANGE, and TS.QUERYINDEX while an atomic slot migration process is in progress, the results may be partial or contain duplicates
fixFT.PROFILE, FT.EXPLAIN, and FT.EXPLACINCLI do not contain the FT.HYBRID option
fixMetrics from FT.HYBRID command are not displayed on FT.INFO and INFO
fixFT.HYBRID: the EXPLAINSCORE, SHARD_K_RATIO, YIELD_DISTANCE_AS, and WITHCURSOR options are not supported
fixFT.HYBRID: post-filtering (after COMBINE step) using FILTER is not supported
fixFT.HYBRID: the default response format considers only key_id and score. This may change for delivering the entire document content
securityHeap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
security#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new…
securityTimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
securityVector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
security(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
securityOut-of-bounds access in TopK heap cleanup path (MOD-15410)
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
security#14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
securityVector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
securityVector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
securityVector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityA crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
securityRedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
fixRedisBloom/RedisBloom#1019 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover
fix#15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
fix#14537 SCAN: restore original filter order (revert change introduced in 8.2)
fix#14816 setModuleEnumConfig() passing prefixed name to module callbacks
fix#14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies
fix#14552 Streams: Incorrect behavior when using XDELEX...ACKED after XGROUP DESTROY`
fix#14420 Shutdown blocked client not being properly reset after shutdown cancellation
fix#14415 Potential crash in lookupKey() when executing_client is NULL
fix#14417 CLUSTER FORGET - heap-buffer-overflow
fix#15188 cluster-announce-ip rejecting hostnames (regression)
fix#14667, #14886 Potential TCP stalls/deadlocks
fixRediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
fixRediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)
security(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
security(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
security(CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
security(CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)
fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
fixCONFIG SET: some settings allow invalid characters (RED-167787)
fixSCRIPT DEBUG: potential crash on scripts (RED-175507)
fixVADD: crash or buffer overflow on large REDUCE value (RED-170921)
fixVSET: crash on huge allocations (MOD-12678)
fixPotential crash on disconnections and TLS failures (Time Series) (MOD-14850)
fixRediSearch/RediSearch#8743 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
fixRediSearch/RediSearch#8850 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
fixRediSearch/RediSearch#9178 Coordinator deadlock under mixed FT.SEARCH and FT.AGGREGATE load (MOD-14268)
fixRediSearch/RediSearch#9049 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
fixRediSearch/RediSearch#8793 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
fixRediSearch/RediSearch#8600 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
fixRediSearch/RediSearch#8662 FILTER behavior depends on property order in the expression (MOD-14342)
fixRediSearch/RediSearch#8602 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
fixRediSearch/RediSearch#8601 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
fixRediSearch/RediSearch#8599 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14062)
fixRediSearch/RediSearch#9019 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
fixRediSearch/RediSearch#9081 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
fixRediSearch/RediSearch#8464 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
fixRediSearch/RediSearch#8888 FT.CURSOR enters an infinite loop when the ACL user lacks specific permissions (MOD-14479)
fixRediSearch/RediSearch#9166 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
fixRediSearch/RediSearch#8453 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14081)
fixRediSearch/RediSearch#9076 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)
featureRediSearch/RediSearch#8235 FT.PROFILE: added queue time tracking (MOD-13602)
securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
securityRedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log
fixRedisJSON/RedisJSON#1430 Malformed panic log messages (MOD-9365)
fixRedisBloom/RedisBloom#945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)
fixRediSearch/RediSearch#6973 Correct empty string token counting in byteOffset calculations to ensure accurate text position tracking (MOD-11233)
fixRediSearch/RediSearch#6995 Prevent FT.INFO command fanout to replicas to reduce unnecessary cluster traffic
fixRediSearch/RediSearch#7034 Correct goto statement handling on RDB load
fixRediSearch/RediSearch#7154 Display Background Indexing OOM warning in FT.AGGREGATE when memory limits are approached (MOD-11817)
fixRediSearch/RediSearch#7219 Resolve concurrency issue in Reducer that caused intermittent errors (MOD-12243)
fixRediSearch/RediSearch#7255 Correct BM25STD underflow wraparound to prevent incorrect scoring (MOD-12223)
fixRediSearch/RediSearch#7264 Ensure accurate totalDocsLen updates to maintain correct document statistics (MOD-12234)
fixRediSearch/RediSearch#7275 Report used memory as unsigned long to prevent overflow (RED-169833)
fixRediSearch/RediSearch#7350 Allow FT.CREATE with LeanVec parameters on non-Intel architectures (RED-176382)
fixRediSearch/RediSearch#7384 Reduce index load from RDB temporary memory overhead (MOD-12212)
fixRediSearch/RediSearch#7435 Ensure full profile output on timeout with RETURN policy in FT.PROFILE (MOD-12320)
fixRediSearch/RediSearch#7446 Remove outdated validation from debug aggregate in cluster mode (MOD-12435)
fixRediSearch/RediSearch#7458 Correct GC regression that caused stability issues (MOD-12538)
fixRediSearch/RediSearch#7459 Prevent potential double-free in Fork GC error path (MOD-12521)
fixRediSearch/RediSearch#7470 Remove draining from Flush callback to avoid blocking
fixRediSearch/RediSearch#7499 Propagate HGETALL command in HDT mode (MOD-12662)
fixRediSearch/RediSearch#7534 Reduce number of worker threads asynchronously to prevent performance degradation (MOD-12252, MOD-11658)
fixRediSearch/RediSearch#7554 Handle Coordinator case when SCORE is sent alone without extra fields (MOD-12647)
fixRediSearch/RediSearch#7561 Prevent memory corruption when freeing searchRequestCtx on error (MOD-12699)
fixRediSearch/RediSearch#7685 Resolve cursor logical leak that could lead to resource exhaustion (MOD-12807)
fixRediSearch/RediSearch#7710 Add support for WITHCOUNT in FT.AGGREGATE (MOD-11751)
fixRediSearch/RediSearch#7794 Correctly handle binary data with embedded NULLs to prevent crashes (MOD-13010)
fixRediSearch/RediSearch#7812 Correct SVS GC for no-workers case (MOD-12983)
fixRediSearch/RediSearch#7873 Handle warnings in empty FT.AGGREGATE replies in cluster mode (MOD-12640)
fixRediSearch/RediSearch#7886 Remove non-TEXT fields from spec's keys dictionary to prevent incorrect field handling (MOD-13150)
fixRediSearch/RediSearch#7901 Support multiple warnings in reply to prevent warning loss (MOD-13252)
fixRediSearch/RediSearch#8083 Correct FULLTEXT field metric count accuracy (MOD-13432)
featureRediSearch/RediSearch#7496 Vector search performance improvements (MOD-12011, MOD-12063, MOD-12629, MOD-12346)
featureRediSearch/RediSearch#7694 Use asynchronous jobs in GC for SVS to reduce blocking (MOD-12668)
featureRediSearch/RediSearch#7737 Add Internal cursor reads metric to cluster FT.PROFILE output (MOD-12414)
featureRediSearch/RediSearch#7552 Add active_io_threads metric (MOD-12069, MOD-12695)
featureRediSearch/RediSearch#7564 Add active_worker_threads metric (MOD-12694, MOD-12069)
featureRediSearch/RediSearch#7623 Add active_coord_threads metric (MOD-12694, MOD-12069)
featureRediSearch/RediSearch#7626 Add *_pending_jobs metrics for job queues (MOD-12069)
featureRediSearch/RediSearch#7672 Add pending workers admin jobs metric (MOD-12069, MOD-12791)
featureRediSearch/RediSearch#7732 Introduce active_topology_update_threads metric (MOD-12069, MOD-12790)
featureRediSearch/RediSearch#7083 Add default scorer configuration option (MOD-10037)
+12 more items in the release notessecurity(CVE-2025-62507) XACKDEL - potential stack overflow and RCE
fixHGETEX - potential crash when FIELDS is used and numfields is missing
fixPotential crash on HyperLogLog with 2GB+ entries
fixCuckoo filter - Division by zero in Cuckoo filter insertion
fixCuckoo filter - Counter overflow
fixBloom filter - Arbitrary memory read/write with invalid filter
fixBloom filter - Out-of-bounds access with empty chain
fixBloom filter - Restore invalid filter [We thank AWS security for responsibly disclosing this security bug]
fixTop-k - Out-of-bounds access
security(CVE-2025-49844) A Lua script may lead to remote code execution
security(CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
security(CVE-2025-46818) A Lua script can be executed in the context of another user
security(CVE-2025-46819) LUA out-of-bound read
feature#14223 VSIM: new EPSILON argument to specify maximum distance
feature#Q6867 SVS-VAMANA: allow use of BUILD_INTEL_SVS_OPT flag for Intel optimisations (MOD-10920)
fix#14319 Potential crash on Lua script defrag
fix#14323 Potential crash on streams and HFE defrag
fix#14330 Potential use-after-free after pubsub and Lua defrag
fix#14288 MEMORY USAGE: fix reported value
fix#14259 XGROUP CREATE, XGROUP SETID: limit ENTRIESREAD value to the number of entries added to the stream
fix#J1374 JSON.DEL doesn’t delete all matching object members / array elements (MOD-11032, MOD-11067)
fix#P886 TDIGEST.CREATE crashes (OOM) on huge initialization values (MOD-10840)
fix#Q6787 Potential shard restart while reindexing vectors on RDB loading (MOD-11011)
fix#Q6676 Potential crash when using small CONSTRUCTION_WINDOW_SIZE on SVS-VAMANA (MOD-10771)
fix#Q6701 Potential crash (OOM) in heavy updates due to a file descriptor leak (MOD-10975)
fix#Q6723 Potential crash when using ACL rules (MOD-10748)
fix#Q6641 INFO SEARCH: search_used_memory_indexes vector index memory value incorrect
fix#Q6665 FT.PROFILE: more accurate execution duration measurements (MOD-10622)
other#Q6648 Improve RESP3 serialization performance (MOD-9687)
feature#Q6671 INFO SEARCH: new SVS-VAMANA metrics
fix#14240 INFO KEYSIZES - potential incorrect histogram updates on cluster mode with modules
fix#14274 Disable Active Defrag during flushing replica
fix#14276 XADD and XTRIM can crash the server after loading an RDB
fix#Q6601 Potential crash when running FLUSHDB (MOD-10681)
breakingQuery Engine - LeanVec and LVQ proprietary Intel optimizations were removed from Redis Open Source
fix#Q6621 Fix regression in INFO (MOD-10779)
featureStreams - new commands: XDELEX and XACKDEL; extension to XADD and XTRIM
featureBitmap - BITOP: new operators: DIFF, DIFF1, ANDOR, and ONE
featureQuery Engine - new SVS-VAMANA vector index type which supports vector compression
otherMore than 15 performance and resource utilization improvements
featureNew metrics: per-slot usage metrics, key size distributions for basic data types, and more
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)
otherRocky Linux 8.10, 9.5
otherAlmaLinux 8.10, 9.5
otherDebian 12 (Bookworm)
othermacOS 13 (Ventura), 14 (Sonoma), 15 (Sequoia)
security(CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
security(CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error
feature#14141 Keyspace notifications - new event types:
featureOVERWRITTEN - the value of a key is completely overwritten
featureTYPE_CHANGED - key type change
fix#14162 Crash when using evport with I/O threads
fix#14163 EVAL crash when error table is empty
fix#14144 Vector sets - RDB format is not compatible with big endian machines
fix#14165 Endless client blocking for blocking commands
fix#14164 Prevent CLIENT UNBLOCK from unblocking CLIENT PAUSE
fix#14216 TTL was not removed by the SET command
fix#14224 HINCRBYFLOAT removes field expiration on replica
feature#Q6430 More compression variants for the SVS-VAMANA vector index
feature#Q6535 SHARD_K_RATIO parameter - favor network latency over accuracy for KNN vector query in a Redis cluster (unstable feature) (MOD-10359)
feature#14144 Vector set - improve RDB loading / RESTORE speed by storing the worst link info
feature#14051 RedisModule_Get*, RedisModule_Set* - allow modules to access Redis configurations
other#14114 RM_UnsubscribeFromKeyspaceEvents - unregister a module from specific keyspace notifications
securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
fixHGETEX - potential crash when FIELDS is used and numfields is missing
fixPotential crash on HyperLogLog with 2GB+ entries
fixCuckoo filter - Division by zero in Cuckoo filter insertion
fixCuckoo filter - Counter overflow
fixBloom filter - Arbitrary memory read/write with invalid filter
fixBloom filter - Out-of-bounds access with empty chain
fixBloom filter - Restore invalid filter [We thank AWS security for responsibly disclosing the security bug]
fixTop-k - Out-of-bounds access
security(CVE-2025-49844) A Lua script may lead to remote code execution
security(CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
security(CVE-2025-46818) A Lua script can be executed in the context of another user
security(CVE-2025-46819) LUA out-of-bound read
feature#14223 VSIM: new EPSILON argument to specify maximum distance
fix#14330 Potential use-after-free after pubsub and Lua defrag
fix#14319 Potential crash on Lua script defrag
fix#14224 HINCRBYFLOAT removes field expiration on replica
fix#14164 Prevent CLIENT UNBLOCK from unblocking CLIENT PAUSE
fix#14165 Endless client blocking for blocking commands
fix#14144 Vector sets - RDB format is not compatible with big endian machines
fix#14163 EVAL crash when error table is empty
fix#14143 Gracefully handle short read errors for hashes with TTL during full sync
security(CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
security(CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error
feature#14065 VSIM: Add new WITHATTRIBS to return the JSON attribute associated with an element
fix#14085 A short read may lead to an exit() on a replica
fix#14092 db->expires is not defragmented
security(CVE-2025-27151) redis-check-aof may lead to stack overflow and potential RCE
fix#14081 Cron-based timers run twice as fast when active defrag is enabled
feature#14048 LOLWUT for Redis 8
feature#13959 Vector sets - faster VSIM FILTER parsing
fix#Q6083 Query Engine - revert default policy search-on-timeout to RETURN
fix#Q6050 Query Engine - @__key on FT.AGGREGATE used as reserved field name preventing access to Redis keyspace
fix#Q6077 Query Engine - crash when calling FT.CURSOR DEL while retrieving from the CURSOR
fixFixed wrong text in the license files
otherName change: Redis Community Edition is now Redis Open Source
otherLicense change: licensed under your choice of
other(a) the Redis Source Available License 2.0 (RSALv2); or
other(b) the Server Side Public License v1 (SSPLv1); or
other(c) the GNU Affero General Public License (AGPLv3)
featureRedis Query Engine and 8 new data structures are now an integral part of Redis 8
other(1) Redis Query Engine, which now supports both horizontal and vertical scaling for search, query and vector workloads
other(2) JSON - a queryable JSON document
other(3) Time series
other(4-8) Five probabilistic data structures: Bloom filter, Cuckoo filter, Count-min sketch, Top-k, and t-digest
other(9) Vector set [beta] - a data structure designed for Vector Similarity Search, inspired by Sorted set
otherThese nine components are included in all binary distributions
otherSee instructions in the README.md file on how to build from source with all these components
featureNew configuration file: redis-full.conf - loads Redis with all these components, and contains new configuration parameters for Redis Query Engine and the new data structures
featureNew ACL categories: @search, @json, @timeseries, @bloom, @cuckoo, @cms, @topk, @tdigest
otherCommands are also included in the existing ACL categories (@read, @write, etc.)
otherMore than 30 performance and resource utilization improvements
featureA new I/O threading implementation which enables throughput increase on multi-core environments (set with io-threads configuration parameter)
otherAn improved replication mechanism which is more performant and robust
featureNew hash commands - HGETDEL, HGETEX, HSETEX
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 20.04 (Focal Fossa), 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)
otherRocky Linux 8.10, 9.5
otherAlmaLinux 8.10, 9.5
otherDebian 11 (Bullseye), 12 (Bookworm)
othermacOS 13 (Ventura), 14 (Sonoma), 15 (Sequoia)
otherFrom previous Redis versions, without modules
otherFrom previous Redis versions with modules (RediSearch, RedisJSON, RedisTimeSeries, RedisBloom)
otherFrom Redis Stack 7.2 or 7.4
security(CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers
fix#13966, #13932 CLUSTER SLOTS - TLS port update not reflected
fix#13958 XTRIM, XADD - incorrect lag due to trimming stream
fix#13931 HGETEX - wrong order of keyspace notifications
fix#J1337 - JSON - JSON.DEL emits no DEL notification when removing the entire value (MOD-9117)
fix#T1742 - Time Series - TS.INFO - duplicatePolicy is nil when set to the default value (MOD-5423)
securityHeap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
security#14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityA crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
security(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
security(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
fixCONFIG SET: some settings allow invalid characters (RED-167787)
fixSCRIPT DEBUG: potential crash on scripts (RED-175507)
securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
fixPotential crash on HyperLogLog with 2GB+ entries
security(CVE-2025-49844) A Lua script may lead to remote code execution
security(CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
security(CVE-2025-46818) A Lua script can be executed in the context of another user
security(CVE-2025-46819) LUA out-of-bound read
fix#14330 Potential use-after-free after pubsub and Lua defrag
fix#14319 Potential crash on Lua script defrag
fix#14164 Prevent CLIENT UNBLOCK from unblocking CLIENT PAUSE
fix#14165 Endless client blocking for blocking commands
fix#14163 EVAL crash when error table is empty
fix#14227 HINCRBYFLOAT removes field expiration on replica
security(CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
security(CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error
security(CVE-2025-27151) redis-check-aof may lead to stack overflow and potential RCE
fix#13966, #13932 CLUSTER SLOTS - TLS port update not reflected in CLUSTER SLOTS
fix#13958 XTRIM, XADD - incorrect lag due to trimming stream
security(CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers
fix#13661 FUNCTION FLUSH - memory leak when using jemalloc
fix#13793 WAITAOF returns prematurely
fix#13853 SLAVEOF - crash when clients are blocked on lazy free
fix#13863 RANDOMKEY - infinite loop during client pause
fix#13877 ShardID inconsistency when both primary and replica support it
security(CVE-2024-46981) Lua script commands may lead to remote code execution
security(CVE-2024-51741) Denial-of-service due to malformed ACL selectors
fix#13627 Crash on module memory defragmentation
fix#13338 Streams: XINFO lag field is wrong when tombstone is after the last_id of the consume group
fix#13473 Streams: XTRIM does not update the maximal tombstone, leading to an incorrect lag
fix#13470 INFO after HDEL show wrong number of hash keys with expiration
fix#13476 Fix a race condition in the cache_memory of functionsLibCtx
fix#13626 Memory leak on failed RDB loading
fix#13539 Hash: fix key ref for a hash that no longer has fields with expiration on RENAME/MOVE/SWAPDB/RESTORE
fix#13443 Cluster: crash when loading cluster config
fix#13422 Cluster: CLUSTER SHARDS returns empty array
fix#13465 Cluster: incompatibility with older node versions
fix#13608 Cluster: SORT ... GET #: incorrect error message
security(CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE
security(CVE-2024-31227) Potential Denial-of-service due to malformed ACL selectors
security(CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching
securityFixes CVE-2024-31449: Lua library commands may lead to stack overflow and potential RCE
securityFixes CVE-2024-31228: Denial-of-service due to unbounded pattern matching
securityFixes CVE-2024-31227: Denial-of-service due to malformed ACL selectors
feature#13391, #13438 Hash - expiration of individual fields: RDB file format changes
feature#13372 Hash - expiration of individual fields: rename and fix counting of expired_subkeys metric
feature#13372 Hash - expiration of individual fields: rename INFO keyspace field to subexpiry
feature#13400 Add hide-user-data-from-log - allows hiding user data from the log file
fix#13407 Trigger Lua GC after SCRIPT LOAD
fix#13380 Fix possible crash due to OOM panic on invalid command
fix#13383 FUNCTION FLUSH - improve Lua GC behavior and fix thread race in ASYNC mode
fix#13408 HEXPIRE-like commands should emit HDEL keyspace notification if expire time is in the past
securityHeap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
securityACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
securityOut-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
securityUse-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityA crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
security(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
security(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
fixCONFIG SET: some settings allow invalid characters (RED-167787)
fixSCRIPT DEBUG: potential crash on scripts (RED-175507)
securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
fixPotential crash on HyperLogLog with 2GB+ entries
security(CVE-2025-49844) A Lua script may lead to remote code execution
security(CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
security(CVE-2025-46818) A Lua script can be executed in the context of another user
security(CVE-2025-46819) LUA out-of-bound read
security(CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
security(CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error
security(CVE-2025-27151) redis-check-aof may lead to stack overflow and potential RCE
fix#13966, #13932 CLUSTER SLOTS - TLS port update not reflected in CLUSTER SLOTS
fix#13958 XTRIM, XADD - incorrect lag due to trimming stream
security(CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers
fix#12817, #12905 Fix race condition issues between the main thread and module threads
fix#13863 RANDOMKEY - infinite loop during client pause
fix#13877 ShardID inconsistency when both primary and replica support it
security(CVE-2024-46981) Lua script commands may lead to remote code execution
security(CVE-2024-51741) Denial-of-service due to malformed ACL selectors
fix#13380 Possible crash due to OOM panic on invalid command
fix#13338 Streams: XINFO lag field is wrong when tombstone is after the last_id of the consume group
fix#13473 Streams: XTRIM does not update the maximal tombstone, leading to an incorrect lag
fix#13311 Cluster: crash due to unblocking client during slot migration
fix#13443 Cluster: crash when loading cluster config
fix#13422 Cluster: CLUSTER SHARDS returns empty array
fix#13465 Cluster: incompatibility with older node versions
security(CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE
security(CVE-2024-31227) Potential Denial-of-service due to malformed ACL selectors
security(CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching
fix#13315 Fixed crashes in cluster mode
fixA single shard cluster leaves failed replicas in CLUSTER SLOTS instead of removing them (#12824)
fixCrash in LSET command when replacing small items and exceeding 4GB (#12955)
fixBlocking commands timeout is reset due to re-processing command (#13004)
fixConversion of numbers in Lua args to redis args can fail. Bug introduced in 7.2.0 (#13115)
fixredis-cli: --count (for --scan, --bigkeys, etc) was ignored unless --pattern was also used (#13092)
fixredis-check-aof: incorrectly considering data in manifest format as MP-AOF (#12958)
security(CVE-2023-41056) In some cases, Redis may incorrectly handle resizing of memory buffers which can result in incorrect accounting of buffer sizes and lead to heap overflow and potential remote code execution.
fixFix crashes of cluster commands clusters with mixed versions of 7.0 and 7.2 (#12805, #12832)
fixFix slot ownership not being properly handled when deleting a slot from a node (#12564)
fixFix atomicity issues with the RedisModuleEvent_Key module API event (#12733)
fixFix file descriptor leak preventing deleted files from freeing disk space on replicas (#12693)
fixFix a possible crash after cluster node removal (#12702)
security(CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup.
fixFix compilation error on MacOS 13 (#12611)
fixWAITAOF could timeout in the absence of write traffic in case a new AOF is created and an AOF rewrite can't immediately start (#12620)
fixFix crash when running rebalance command in a mixed cluster of 7.0 and 7.2 nodes (#12604)
fixFix the return type of the slot number in cluster shards to integer, which makes it consistent with past behavior (#12561)
fixFix CLUSTER commands are called from modules or scripts to return TLS info appropriately (#12569)
fixredis-cli, fix crash on reconnect when in SUBSCRIBE mode (#12571)
fixFix overflow calculation for next timer event (#12474)
security(CVE-2023-41053) Redis does not correctly identify keys accessed by SORT_RO and, as a result, may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration.
fixFix crashes when joining a node to an existing 7.0 Redis Cluster (#12538)
fixCorrect request_policy and response_policy command tips on for some admin / configuration commands (#12545, #12530)
securityFixes CVE-2024-31449: Lua library commands may lead to stack overflow and potential RCE
securityFixes CVE-2024-31228: Denial-of-service due to unbounded pattern matching
securityFixes CVE-2023-45145: Redis Unix-domain socket may be exposed with the wrong permissions for a short time window.
fixredis-cli in cluster mode handles unknown-endpoint (#12273)
fixUpdate request / response policy hints for a few commands (#12417)
fixEnsure that the function load timeout is disabled during loading from RDB/AOF and on replicas. (#12451)
fixFix false success and a memory leak for ACL selector with bad parenthesis combination (#12452)
fixFix the assertion when script timeout occurs after it signaled a blocked client (#12459)
fixUpdate MONITOR client's memory correctly for INFO and client-eviction (#12420)
fixThe response of cluster nodes was unnecessarily adding an extra comma when no hostname was present. (#12411)
security(CVE-2023-41056) In some cases, Redis may incorrectly handle resizing of memory buffers which can result in incorrect accounting of buffer sizes and lead to heap overflow and potential remote code execution.
security(CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup.
security(CVE-2023-41053) Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration.
fixCluster: fix a race condition where a slot migration may revert on a subsequent failover or node joining (#12344)
fixEnsure that the function load timeout is disabled during loading from RDB/AOF and on replicas. (#12451)
fixFix the assertion when script timeout occurs after it signaled a blocked client (#12459)
security(CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and…
security(CVE-2023-36824) Extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Specifically: using COMMAND GETKEYS* and validation of key names in ACL rules.
fixRe-enable downscale rehashing while there is a fork child (#12276)
fixFix possible hang in HRANDFIELD, SRANDMEMBER, ZRANDMEMBER when used with (#12276)
fixImprove fairness issue in RANDOMKEY, HRANDFIELD, SRANDMEMBER, ZRANDMEMBER, SPOP, and eviction (#12276)
fixFix WAIT to be effective after a blocked module command being unblocked (#12220)
fixAvoid unnecessary full sync after master restart in a rare case (#12088)
security(CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access
fixAdd a missing fsync of AOF file in rare cases (#11973)
fixDisconnect pub-sub subscribers when revoking allchannels permission (#11992)
featureFix a compiler fortification induced crash when used with link time optimizations (#11982)
security(CVE-2023-28425) Specially crafted MSETNX command can lead to assertion and denial-of-service
fixLarge blocks of replica client output buffer may lead to PSYNC loops and unnecessary memory usage (#11666)
fixFix CLIENT REPLY OFF|SKIP to not silence push notifications (#11875)
fixTrim excessive memory usage in stream nodes when exceeding stream-node-max-bytes (#11885)
fixFix module RM_Call commands failing with OOM when maxmemory is changed to zero (#11319)
security(CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process.
security(CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time.
fixFix a crash when reaching the maximum invalidations limit of client-side tracking (#11814)
fixFix a crash when SPUBLISH is used after passing the cluster-link-sendbuf-limit (#11752)
fixFix possible memory corruption in FLUSHALL when a client watches more than one key (#11854)
fixFix cluster inbound link keepalive time (#11785)
fixFlush propagation list in active-expire of writable replicas to fix an assertion (#11615)
fixAvoid propagating DEL of lazy expire from SCAN and RANDOMKEY as MULTI-EXEC (#11788)
featureAvoid realloc to reduce size of strings when it is unneeded (#11766)
featureImprove CLUSTER SLOTS reply efficiency for non-continuous slots (#11745)
security(CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic
security(CVE-2023-22458) Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands can lead to denial-of-service
fixAvoid possible hang when client issues long KEYS, SRANDMEMBER, HRANDFIELD, and ZRANDMEMBER commands and gets disconnected by client output buffer limit (#11676)
fixMake sure that fork child doesn't do incremental rehashing (#11692)
fixFix a bug where blocking commands with a sub-second timeout would block forever (#11688)
fixFix sentinel issue if replica changes IP (#11590)
fixFix regression from Redis 7.0.6 in distance replies of Geo commands (#11631)
breakingRM_ResetDataset module API should not clear the functions (#11268)
breakingRM_Call module API used with the "C" flag to run scripts, would now cause the commands in the script to check ACL with the designated user (#10966)
featureGeo commands speedups (#11535, #11522, #11552, #11579)
featureFix EVAL command performance regression from Redis 7.0 (#11521, #11541)
featureReduce EXPIRE commands performance regression from Redis 7.0 (#11602)
featureOptimize commands returning double values, mainly affecting zset commands (#11093)
featureOptimize Lua parsing of some command responses (#11556)
featureOptimize client memory usage tracking operation while client eviction is disabled (#11348)
featureFix compilation on Solaris (#11327)
otherRM_SetContextUser, RM_SetModuleUserACLString, RM_GetModuleUserACLString (#10966)
fixFix crash in CLIENT_CHANGE event, when the selected database is not 0 (#11500)
otherredis-benchmark avoid aborting on NOPERM from CONFIG GET (#11096)
fixAvoid hang of diskless replication fork child when parent crashes (#11463)
fixFix crash with module API of list iterator and RM_ListDelete (#11383)
fixFix TLS error handling to avoid connection drops on timeouts (#11563)
fixFix runtime changes to cluster-announce-*-port to take effect on the local node too (#10745)
fixFix sentinel function that compares hostnames if failed resolve (#11419)
fixFix MIGRATE with AUTH set to "keys" is getting wrong key names leading to MOVED or ACL errors (#11253)
fixFix command line startup --sentinel problem (#11591)
fixFis missing FCALL commands in monitor (#11510)
fixFix CLUSTER SHARDS showing empty hostname (#11297)
fixReplica that asks for rdb-only could have missed the EOF and hang (#11296)
security(CVE-2022-35951) Executing a XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument, may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. The problem affects Redis versions 7.0.0 or newer [reported by…
fixFix RM_Call execution of scripts when used with M/W/S flags to properly handle script flags (#11159)
fixFix RM_SetAbsExpire and RM_GetAbsExpire API registration (#11025, #8564)
fixFix a hang when eviction is combined with lazy-free and maxmemory-eviction-tenacity is set to 100 (#11237)
fixFix a crash when a replica may attempt to set itself as its master as a result of a manual failover (#11263)
fixFix a bug where a cluster-enabled replica node may permanently set its master's hostname to '?' (#10696)
fixFix a crash when a Lua script returns a meta-table (#11032)
fixFix redis-cli to do DNS lookup before sending CLUSTER MEET (#11151)
fixFix crash when a key is lazy expired during cluster key migration (#11176)
fixFix AOF rewrite to fsync the old AOF file when a new one is created (#11004)
fixFix some crashes involving a list containing entries larger than 1GB (#11242)
fixCorrectly handle scripts with a non-read-only shebang on a cluster replica (#11223)
fixFix memory leak when unloading a module (#11147)
fixFix bug with scripts ignoring client tracking NOLOOP (#11052)
fixFix client-side tracking breaking protocol when FLUSHDB / FLUSHALL / SWAPDB is used inside MULTI-EXEC (#11038)
fixFix ACL: BITFIELD with GET and also SET / INCRBY can be executed with read-only key permission (#11086)
fixFix missing sections for INFO ALL when also requesting a module info section (#11291)
security(CVE-2022-31144) A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. The problem affects Redis versions 7.0.0 or newer.
featureOptimize zset conversion on large ZRANGESTORE (#10789)
featureOptimize the performance of sending PING on large clusters (#10624)
featureAllow for faster restart of Redis in cluster mode (#10912)
featureAdd missing sharded pubsub keychannel count to CLIENT LIST (#10895)
featureAdd missing pubsubshard_channels field in INFO STATS (#10929)
featureAdd RM_StringToULongLong and RM_CreateStringFromULongLong (#10889)
featureAdd RM_SetClientNameById and RM_GetClientNameById (#10839)
featureAdd missing cluster-port support to redis-cli --cluster (#10344)
featureAccount sharded pubsub channels memory consumption (#10925)
featureAllow ECHO in loading and stale modes (#10853)
featureCluster: Throw -TRYAGAIN instead of -ASK on migrating nodes for multi-key commands when the node only has some of the keys (#9526)
fixTLS: Notify clients on connection shutdown (#10931)
fixFsync directory while persisting AOF manifest, RDB file, and config file (#10737)
fixScript that made modification will not break with unexpected NOREPLICAS error (#10855)
fixCluster: Fix a bug where nodes may not acknowledge a CLUSTER FAILOVER TAKEOVER after a replica reboots (#10798)
fixCluster: Fix crash during handshake and cluster shards call (#10942)
fixTLS: Fix issues with large replies (#10909)
fixCorrectly report the startup warning for vm.overcommit_memory (#10841)
fixredis-server command line allow passing config name and value in the same argument (#10866)
fixSupport --save command line argument with no value for backwards compatibility (#10866)
fixFix CLUSTER RESET command regression requiring an argument (#10898)
fixFixed SET and BITFIELD commands being wrongly marked movablekeys (#10837) Regression in 7.0 possibly resulting in excessive roundtrip from cluster clients.
fixFix crash when /proc/sys/vm/overcommit_memory is inaccessible (#10848) Regression in 7.0.1 resulting in crash on startup on some configurations.
featureAdd warning for suspected slow system clocksource setting Add --check-system command line option. (#10636)
featureAllow read-only scripts (*_RO commands, and ones with no-writes flag) during CLIENT PAUSE WRITE (#10744)
featureAdd readonly flag in COMMAND command for EVAL_RO, EVALSHA_RO and FCALL_RO (#10728)
featureredis-server command line arguments now accept one string with spaces for multi-arg configs (#10660)
breakingOmitting a config option value in command line argument no longer works (#10660)
breakingHide the may_replicate flag from the COMMAND command response (#10744)
breakingProtocol: Sharded pubsub publish emits smessage instead of message (#10792)
breakingCLUSTER SHARDS returns slots as RESP integers, not strings (#10683)
breakingBlock PFCOUNT and PUBLISH in read-only scripts (*_RO commands, and no-writes) (#10744)
breakingScripts that declare the no-writes flag are implicitly allow-oom too (#10699)
otherredis-cli --bigkeys, --memkeys, --hotkeys, --scan. Finish nicely after Ctrl+C (#10736)
featureSupport tcp-keepalive config interval on MacOs (#10667)
featureSupport RSS metrics on Haiku OS (#10687)
featureAdd isolated network metrics for replication. (#10062, #10810)
featureAdd two more new checks to RM_Call script mode (#10786)
featureAdd new RM_Call flag to let Redis automatically refuse deny-oom commands (#10786)
featureAdd module API RM_MallocUsableSize (#10795)
featureAdd missing REDISMODULE_NOTIFY_NEW (#10688)
fixFix cursor type in RedisModuleScanCursor to handle more than 2^31 elements (#10698)
fixFix RM_Yield bugs and RM_Call("EVAL") OOM check bug (#10786)
fixFix bugs in enum configs with overlapping bit flags (#10661)
fixFLUSHALL correctly resets rdb_changes_since_last_save INFO field (#10691)
fixFLUSHDB is now propagated to replicas / AOF, even if the db is empty (#10691)
fixReplica fail and retry the PSYNC if the master is unresponsive (#10726)
fixFix ZRANGESTORE crash when zset_max_listpack_entries is 0 (#10767)
fixCONFIG REWRITE could cause a config change to be dropped for aliased configs (#10811)
fixCONFIG REWRITE would omit rename-command and include lines (#10761) NOTE: Affected users who used Redis 7.0.0 to rewrite their configuration file should review and fix the file.
fixFix broken protocol after MISCONF (persistence) error (#10786)
fixFix --save command line regression (#10690)
fixFix possible regression around TLS config changes. re-load files even if the file name didn't change. (#10713)
fixRe-add SENTINEL SLAVES command, missing in redis 7.0 (#10723)
fixBZMPOP gets unblocked by non-key args and returns them (#10764)
fixFix possible memory leak in XADD and XTRIM (#10753)
securityFixes CVE-2023-45145: Redis Unix-domain socket may be exposed with the wrong permissions for a short time window.
security(CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. This issue affects all versions of Redis. [reported by Aviv Yahav].
security(CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. [reported by Aviv Yahav].
featureKeyspace event for new keys (#10512)
featureCOMMAND DOCS shows deprecated_since field in command args (#10545)
featureCOMMAND DOCS shows module name where applicable (#10544)
breakingReplicas panic when they fail writing persistence (#10504)
breakingPrevent cross slot operations in functions and scripts with shebang (#10615)
breakingRephrased some error responses about invalid commands or args (#10612)
breakingLua scripts do not have access to the print() function (#10651)
featureSpeed optimization in streams (#10574)
featureSpeed optimization in command execution pipeline (#10502)
featureSpeed optimization in listpack encoded sorted (#10486)
featureSpeed optimization in latency tracking at INFO (relevant for 7.0 RCs) (#10606)
featureSpeed optimization when there are many replicas (relevant for 7.0 RCs) (#10588)
featureAllow ignoring disk persistence errors on replicas (#10504)
featureAllow abort with panic when replica fails to execute a command sent by the master (#10504)
featureAllow configuring shutdown flags of SIGTERM and SIGINT (#10594)
featureAllow attaching an operating system-specific identifier to Redis sockets (#10349)
breakingAdd argument specifying ACL reason for module log entry (#10559) Breaking API compatibility with 7.0 RCs
breakingAdd the deprecated_since field in command args of COMMAND DOCS (#10545) Breaking API/ABI compatibility with 7.0 RCs
featureAdd module API flag for using enum configs as bit flags (#10643)
featureAdd RM_PublishMessageShard (#10543)
featureAdd RM_MallocSizeString, RM_MallocSizeDict (#10542)
featureAdd RM_TryAlloc (#10541)
fixReplica report disk persistence errors in PING (#10603)
fixFixes around rejecting commands on replicas and AOF when they must be respected (#10603)
fixDurability fixes for appendfsync=always policy (#9678)
fixFix possible crash on CONFIG REWRITE (#10598)
fixFix regression not aborting transaction on errors (#10612)
fixFix auto-aof-rewrite-percentage based AOFRW trigger after restart (#10550)
fixFix bugs when AOF enabled after startup, in case of failure before the first rewrite completes (#10616)
fixFix RM_Yield module API bug processing future commands of the current client (#10573)
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
securityA crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
fixSCRIPT DEBUG: potential crash on scripts (RED-175507)
fixPotential crash on HyperLogLog with 2GB+ entries
security(CVE-2025-49844) A Lua script may lead to remote code execution
security(CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
security(CVE-2025-46818) A Lua script can be executed in the context of another user
security(CVE-2025-46819) LUA out-of-bound read
security(CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
security(CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error
security(CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers
security(CVE-2024-46981) Lua script commands may lead to remote code execution
security(CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE.
security(CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching.
security(CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup.
security(CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and…
fixRe-enable downscale rehashing while there is a fork child (#12276)
security(CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access
fixFix CLIENT REPLY OFF|SKIP to not silence push notifications (#11875)
fixDisconnect pub-sub subscribers when revoking allchannels permission (#11992)
fixTrim excessive memory usage in stream nodes when exceeding stream-node-max-bytes (#11885)
security(CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process.
security(CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time.
fixFix a crash when reaching the maximum invalidations limit of client-side tracking (#11814)
fixFix cluster inbound link keepalive time (#11785)
fixMake sure that fork child doesn't do incremental rehashing (#11692)
featureAvoid realloc to reduce size of strings when it is unneeded (#11766)
fixRevert the change to KEYS in the recent client output buffer limit fix (#11676)
security(CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic
security(CVE-2023-22458) Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands can lead to denial-of-service
fixAvoid possible hang when client issues long KEYS, SRANDMEMBER, HRANDFIELD, and ZRANDMEMBER commands and gets disconnected by client output buffer limit (#11676)
fixFix sentinel issue if replica changes IP (#11590)
featureOptimize zset conversion on large ZRANGESTORE (#10789)
fixFix crash in CLIENT_CHANGE event, when the selected database is not 0 (#11500)
fixFix RM_SetAbsExpire and RM_GetAbsExpire API registration (#11025, #8564)
securitySentinel: avoid logging auth-pass value (#9652)
fixFix a crash when a Lua script returns a meta-table (#11032)
fixFix ZRANGESTORE crash when zset_max_listpack_entries is 0 (#10767)
fixUnpause clients after manual failover ends instead of waiting for timed (#9676)
fixTLS: Notify clients on connection shutdown (#10931)
fixAvoid hang of diskless replication fork child when parent crashes (#11463)
fixFix sentinel function that compares hostnames if failed resolve (#11419)
fixFix a hang when eviction is combined with lazy-free and maxmemory-eviction-tenacity is set to 100 (#11237)
fixFix bug with scripts ignoring client tracking NOLOOP (#11052)
fixFix client-side tracking breaking protocol when FLUSHDB / FLUSHALL / SWAPDB is used inside MULTI-EXEC (#11038)
fixFix BITFIELD overflow detection on some compilers due to undefined behavior (#9601)
security(CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. This issue affects all versions of Redis. [reported by Aviv Yahav].
security(CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. [reported by Aviv Yahav].
breakingLPOP/RPOP with count against non-existing list return null array (#10095)
breakingLPOP/RPOP used to produce wrong replies when count is 0 (#9692)
featureSpeed optimization in command execution pipeline (#10502)
featureFix regression in Z[REV]RANGE commands (by-rank) introduced in Redis 6.2 (#10337)
featureFix RSS metrics on NetBSD and OpenBSD (#10116, #10149)
featureFix OpenSSL 3.0.x related issues (#10291)
fixLua: Add checks for min-slave-* configs when evaluating Lua scripts (#10160)
fixLua: fix crash on a script call with many arguments, a regression in v6.2.6 (#9809)
fixTracking: Make invalidation messages always after command's reply (#9422)
fixFix excessive stream trimming due to an overflow (#10068)
fixAdd missed error counting for INFO errorstats (#9646)
fixFix geo search bounding box check causing missing results (#10018)
fixImprove EXPIRE TTL overflow detection (#9839)
fixModules: Fix thread safety violation when a module thread adds an error reply, broken in 6.2 (#10278)
fixModules: Fix missing and duplicate error stats (#10278)
fixModule APIs: release clients blocked on module commands in cluster resharding and down state (#9483)
fixSentinel: Fix memory leak with TLS (#9753)
fixSentinel: Fix issues with hostname support (#10146)
fixSentinel: Fix election failures on certain container environments (#10197)
security(CVE-2021-41099) Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured to a non-default, very large value [reported by yiyuaner].
security(CVE-2021-32762) Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms [reported by Microsoft Vulnerability Research].
security(CVE-2021-32687) Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value [reported by Pawel Wieczorkiewicz, AWS].
security(CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections.
security(CVE-2021-32672) Random heap reading issue with Lua Debugger [reported by Meir Shpilraien].
security(CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value [reported by sundb].
security(CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for proto-max-bulk-len and client-query-buffer-limit [reported by sundb].
security(CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow [reported by Meir Shpilraien].
fixGEO* STORE with empty source key deletes the destination key and return 0 (#9271) Previously it would have returned an empty array like the non-STORE variant.
fixPUBSUB NUMPAT replies with number of patterns rather than number of subscriptions (#9209) This actually changed in 6.2.0 but was overlooked and omitted from the release notes.
fixFix CLIENT PAUSE, used an old timeout from previous PAUSE (#9477)
fixFix CLIENT PAUSE in a replica would mess the replication offset (#9448)
fixAdd some missing error statistics in INFO errorstats (#9328)
fixFix incorrect reply of COMMAND command key positions for MIGRATE command (#9455)
fixFix appendfsync to always guarantee fsync before reply, on MacOS and FreeBSD (kqueue) (#9416)
fixFix the wrong mis-detection of sync_file_range system call, affecting performance (#9371)
otherWhen redis-cli received ASK response, it didn't handle it (#8930)
featureAdd latency monitor sample when key is deleted via lazy expire (#9317)
featureSanitize corrupt payload improvements (#9321, #9399)
featureDelete empty keys when loading RDB file or handling a RESTORE command (#9297, #9349)
securityFix integer overflow in BITFIELD on 32-bit versions (CVE-2021-32761). An integer overflow bug in Redis version 2.2 or newer can be exploited using the BITFIELD command to corrupt the heap and potentially result with remote code execution.
fixChange reply type for ZPOPMAX/MIN with count in RESP3 to nested array (#8981). Was using a flat array like in RESP2 instead of a nested array like ZRANGE does.
fixFix reply type for HRANDFIELD and ZRANDMEMBER when key is missing (#9178). Was using a null array instead of an empty array.
fixFix reply type for ZRANGESTORE when source key is missing (#9089). Was using an empty array like ZRANGE instead of 0 (used in the STORE variant).
fixZRANDMEMBER WITHSCORES with negative COUNT may return bad score (#9162)
fixFix crash after CLIENT UNPAUSE when threaded I/O config is enabled (#9041)
fixFix XTRIM or XADD with LIMIT may delete more entries than the limit (#9048)
fixFix build issue with OpenSSL 1.1.0 (#9233)
fixFail EXEC command in case a watched key is expired (#9194)
fixFix SMOVE not to invalidate dest key (WATCH and tracking) when member already exists (#9244)
fixFix SINTERSTORE not to delete dest key when getting a wrong type error (#9032)
fixFix overflows on 32-bit versions in GETBIT, SETBIT, BITCOUNT, BITPOS, and BITFIELD (#9191)
fixImprove MEMORY USAGE on stream keys (#9164)
fixSet TCP keepalive on inbound cluster bus connections (#9230)
fixFix diskless replica loading to recover from RDB short read on module AUX data (#9199)
fixFix race in client side tracking (#9116)
fixFix ziplist length updates on big-endian platforms (#2080)
otherredis-cli cluster import command may issue wrong MIGRATE command, sending COPY instead of REPLACE (#8945)
otherredis-cli --rdb fixes when using "-" to write to stdout (#9136, #9135)
featureredis-cli support for RESP3 set type in CSV and RAW output (#7338)
otherModule API for getting current command name (#8792)
fixFix RM_StringTruncate when newlen is 0 (#3718)
fixFix CLIENT UNBLOCK crashing modules without timeout callback (#9167)
securityFix integer overflow in STRALGO LCS (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477.
fixFix crash after a diskless replication fork child is terminated (#8991)
fixFix redis-benchmark crash on unsupported configs (#8916)
fixFix crash in UNLINK on a stream key with deleted consumer groups (#8932)
fixSINTERSTORE: Add missing keyspace del event when none of the sources exist (#8949)
fixSentinel: Fix CONFIG SET of empty string sentinel-user/sentinel-pass configs (#8958)
fixEnforce client output buffer soft limit when no traffic (#8833)
featureHide AUTH passwords in MIGRATE command from slowlog (#8859)
securityInteger overflow in STRALGO LCS command (CVE-2021-29477): An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting…
securityInteger overflow in COPY command for large intsets (CVE-2021-29478): An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result in remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a…
fixFix memory leak in moduleDefragGlobals (#8853)
fixFix memory leak when doing lazy freeing client tracking table (#8822)
fixBlock abusive replicas from sending commands that could assert and crash redis (#8868)
fixUse a monotonic clock to check for Lua script timeout (#8812)
fixredis-cli: Do not use unix socket when we got redirected in cluster mode (#8870)
fixFix RM_GetClusterNodeInfo() to correctly populate master id (#8846)
fixFix BGSAVE, AOFRW, and replication slowdown due to child reporting CoW (#8645)
fixFix short busy loop when a timer event is about to fire (#8764)
fixFix default user, overwritten and reset users losing Pub/Sub channel permissions (#8723)
fixFix config rewrite with an empty save config resulting in default save values (#8719)
fixFix not starting on alpine/libmusl without IPv6 (#8655)
fixFix issues with propagation and MULTI/EXEC in modules (#8617) Several issues around nested calls and thread-safe contexts
fixFix early rejection of PUBLISH inside MULTI-EXEC transaction (#8534)
fixFix missing SLOWLOG records for blocked commands (#8632)
featureAllow RESET command during busy scripts (#8629)
fixFix some error replies that were not counted on stats (#8659)
fixAdd a timeout mechanism for replicas stuck in fullsync (#8762)
fixProcess HELLO command even if the default user has no permissions (#8633)
fixClient issuing a long-running script and using a pipeline, got disconnected (#8715)
fixFix script kill to work also on scripts that use pcall (#8661)
fixFix list-compress-depth may compress more node than required (#8311)
fixFix redis-cli handling of rediss:// URL scheme (#8705)
fixCluster: Skip unnecessary check which may prevent failure detection (#8585)
fixCluster: Fix hang manual failover when replica just started (#8651)
fixSentinel: Fix info-refresh time field before sentinel gets a first response (#8567)
fixSentinel: Fix possible crash on failed connection attempt (#8627)
fixSystemd: Send the readiness notification when a replica is ready to accept connections (#8409)
fixZADD: fix awrong reply when INCR used with GT/LT which blocked the update (#8717) It was responding with the incremented value rather than nil
fixXAUTOCLAIM: fix response to return the next available id as the cursor (#8725) Previous behavior was returning the last one which was already scanned
fixXAUTOCLAIM: fix JUSTID to prevent incrementing delivery_count (#8724)
featureAdd cluster-allow-replica-migration config option (#5285)
featureAdd replica-announced config option (#8653)
featureAdd support for plaintext clients in TLS cluster (#8587)
featureAdd support for reading encrypted keyfiles (#8644)
featureFix performance regression in BRPOP on Redis 6.0 (#8689)
featureAvoid adding slowlog entries for config with sensitive data (#8584)
featureImprove redis-cli non-binary safe string handling (#8566)
featureOptimize CLUSTER SLOTS reply (#8541)
featureHandle remaining fsync errors (#8419)
fixFix RSS memory info on FreeBSD (#8620)
fixFix client_recent_max_input/output_buffer in 'INFO CLIENTS' when all clients drop (#8588)
fixFix invalid master_link_down_since_seconds in info replication (#8785)
fixFix FreeBSD <12.x builds (#8603)
featureAdd macros for RedisModule_log logging levels (#4246)
featureAdd RedisModule_GetAbsExpire / RedisModule_SetAbsExpire (#8564)
featureAdd a module type for key space notification (#8759)
+6 more items in the release notesfixFix sanitize-dump-payload for stream with deleted records (#8568)
fixPrevent client-query-buffer-limit config from being set to lower than 1mb (#8557)
featureMake port, tls-port and bind config options modifiable at runtime (#8510)
fixFix compilation error on non-glibc systems if jemalloc is not used (#8533)
otherImproved memory consumption and memory usage tracking on FreeBSD (#8545)
fixFix compilation on ARM64 MacOS with jemalloc (#8458)
featureNew Module API for getting user name of a client (#8508)
otherOptimize RM_Call by utilizing a shared reusable client (#8516)
fixFix crash running CLIENT INFO via RM_Call (#8560)
securityInteger overflow on 32-bit systems (CVE-2021-21309): Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger…
fixAvoid 32-bit overflows when proto-max-bulk-len is set high (#8522)
fixFix broken protocol in client tracking tracking-redir-broken message (#8456)
fixAvoid unsafe field name characters in INFO commandstats, errorstats, modules (#8492)
fixXINFO able to access expired keys during CLIENT PAUSE WRITE (#8436)
fixFix allowed length for REPLCONF ip-address, needed due to Sentinel's support for hostnames (#8517)
fixFix broken protocol in redis-benchmark when used with -a or --dbnum (#8486)
fixXADD counts deleted records too when considering switching to a new listpack (#8390)
fixFixes in GEOSEARCH bybox (accuracy and mismatch between width and height) (#8445)
fixFix risk of OOM panic in HRANDFIELD, ZRANDMEMBER commands with huge negative count (#8429)
fixFix duplicate replicas issue in Sentinel, needed due to hostname support (#8481)
fixFix Sentinel configuration rewrite, an improvement of #8271 (#8480)
otherSRANDMEMBER uses RESP3 array type instead of set type (#8504)
otherEXPIRE, EXPIREAT, SETEX, GETEX: Return error when provided expire time overflows (#8287)
breakingRemove ACL subcommand validation if fully added command exists. (#8483)
featureOptimize sorting in GEORADIUS / GEOSEARCH with COUNT (#8326)
featureOptimize HRANDFIELD and ZRANDMEMBER case 4 when ziplist encoded (#8444)
featureOptimize in-place replacement of elements in HSET, HINCRBY, LSET (#8493)
featureRemove redundant list to store pubsub patterns (#8472)
featureAdd --insecure option to command line tools (#8416)
featureAdd INFO fields to track progress of BGSAVE, AOFRW, replication (#8414)
fixRM_ZsetRem: Delete key if empty, the bug could leave empty zset keys (#8453)
featureRM_HashSet: Add COUNT_ALL flag and set errno (#8446)
security(CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and…
fixRe-enable downscale rehashing while there is a fork child (#12276)
security(CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access
fixFix CLIENT REPLY OFF|SKIP to not silence push notifications (#11875)
security(CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process.
security(CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time.
fixMake sure that fork child doesn't do incremental rehashing (#11692)
fixFix cluster inbound link keepalive time (#11785)
security(CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic
fixAvoid hang when client issues long SRANDMEMBER command and gets disconnected by client output buffer limit (#11676)
fixLua: fix crash on a script call with many arguments, a regression in v6.0.16 (#9809)
fixLua: Add checks for min-slave-* configs when evaluating Lua scripts (#10160)
fixFix BITFIELD overflow detection on some compilers due to undefined behavior (#9601)
security(CVE-2021-41099) Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured to a non-default, very large value [reported by yiyuaner].
security(CVE-2021-32762) Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms [reported by Microsoft Vulnerability Research].
security(CVE-2021-32687) Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value [reported by Pawel Wieczorkiewicz, AWS].
security(CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections.
security(CVE-2021-32672) Random heap reading issue with Lua Debugger [reported by Meir Shpilraien].
security(CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value [reported by sundb].
security(CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for proto-max-bulk-len and client-query-buffer-limit [reported by sundb].
security(CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow [reported by Meir Shpilraien].
fixFix appendfsync to always guarantee fsync before reply, on MacOS and FreeBSD (kqueue) (#9416)
fixFix the wrong mis-detection of sync_file_range system call, affecting performance (#9371)
fixFix replication issues when repl-diskless-load is used (#9280)
securityFix integer overflow in BITFIELD on 32-bit versions (CVE-2021-32761). An integer overflow bug in Redis version 2.2 or newer can be exploited using the BITFIELD command to corrupt the heap and potentially result with remote code execution.
fixChange reply type for ZPOPMAX/MIN with count in RESP3 to nested array (#8981). Was using a flat array like in RESP2 instead of a nested array like ZRANGE does.
fixFail EXEC command in case a watched key is expired (#9194)
fixFix SMOVE not to invalidate dest key (WATCH and tracking) when member already exists (#9244)
fixFix SINTERSTORE not to delete dest key when getting a wrong type error (#9032)
fixFix overflows on 32-bit versions in GETBIT, SETBIT, BITCOUNT, BITPOS, and BITFIELD (#9191)
fixSet TCP keepalive on inbound cluster bus connections (#9230)
fixFix ziplist length updates on big-endian platforms (#2080)
fixFix diskless replica loading to recover from RDB short read on module AUX data (#9199)
fixFix race in client side tracking (#9116)
fixIf diskless repl child is killed, make sure to reap the child pid (#7742)
fixAdd a timeout mechanism for replicas stuck in fullsync (#8762)
otherredis-cli cluster import support source and target that require auth (#7994)
otherredis-cli cluster import command may issue wrong MIGRATE command, sending COPY instead of REPLACE (#8945)
featureredis-cli support for RESP3 set type in CSV and RAW output (#7338)
securityFix integer overflow in STRALGO LCS (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477.
fixFix crash in UNLINK on a stream key with deleted consumer groups (#8932)
fixSINTERSTORE: Add missing keyspace del event when none of the sources exist (#8949)
securityInteger overflow in STRALGO LCS command (CVE-2021-29477): An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting…
securityInteger overflow in COPY command for large intsets (CVE-2021-29478): An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result in remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a…
fixCluster: Skip unnecessary check which may prevent failure detection (#8585)
fixFix not starting on alpine/libmusl without IPv6 (#8655)
featureFix performance regression in BRPOP on Redis 6.0 (#8689)
fixFix edge-case when a module client is unblocked (#8618)
fixFix compilation error on non-glibc systems if jemalloc is not used (#8533)
securityInteger overflow on 32-bit systems (CVE-2021-21309): Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger…
fixAvoid 32-bit overflows when proto-max-bulk-len is set high (#8522)
fixFix handling of threaded IO and CLIENT PAUSE (failover), could lead to data loss or a crash (#8520)
fixFix the selection of a random element from large hash tables (#8133)
fixFix broken protocol in client tracking tracking-redir-broken message (#8456)
fixXINFO able to access expired keys on a replica (#8436)
fixFix broken protocol in redis-benchmark when used with -a or --dbnum (#8486)
fixAvoid assertions (on older kernels) when testing arm64 CoW bug (#8405)
fixCONFIG REWRITE should honor umask settings (#8371)
fixFix firstkey,lastkey,step in COMMAND command for some commands (#8367)
fixRM_ZsetRem: Delete key if empty, the bug could leave empty zset keys (#8453)
otherSWAPDB invalidates WATCHed keys (#8239)
otherSORT command behaves differently when used on a writable replica (#8283)
otherEXISTS should not alter LRU (#8016) In Redis 5.0 and 6.0 it would have touched the LRU/LFU of the key.
otherOBJECT should not reveal logically expired keys (#8016) Will now behave the same TYPE or any other non-DEBUG command.
otherGEORADIUS[BYMEMBER] can fail with -OOM if Redis is over the memory limit (#8107)
fixSentinel: Fix missing updates to the config file after SENTINEL SET command (#8229)
otherCONFIG REWRITE is atomic and safer, but requires write access to the config file's folder (#7824, #8051) This change was already present in 6.0.9, but was missing from the release notes.
fixFix RDB CRC64 checksum on big-endian systems (#8270) If you're using big-endian please consider the compatibility implications with RESTORE, replication and persistence.
fixFix wrong order of key/value in Lua's map response (#8266) If your scripts use redis.setresp() or return a map (new in Redis 6.0), please consider the implications.
fixFix an issue where a forked process deletes the parent's pidfile (#8231)
fixFix crashes when enabling io-threads-do-reads (#8230)
fixFix a crash in redis-cli after executing cluster backup (#8267)
fixHandle output buffer limits for module blocked clients (#8141) Could result in a module sending reply to a blocked client to go beyond the limit.
fixFix setproctitle related crashes. (#8150, #8088) Caused various crashes on startup, mainly on Apple M1 chips or under instrumentation.
fixBackup/restore cluster mode keys to slots map for repl-diskless-load=swapdb (#8108) In cluster mode with repl-diskless-load, when loading failed, slot map wouldn't have been restored.
fixFix oom-score-adj-values range, and bug when used in config file (#8046) Enabling setting this in the config file in a line after enabling it, would have been buggy.
fixReset average ttl when empty databases (#8106) Just causing misleading metric in INFO
fixDisable rehash when Redis has child process (#8007) This could have caused excessive CoW during BGSAVE, replication or AOFRW.
fixFurther improved ACL algorithm for picking categories (#7966) Output of ACL GETUSER is now more similar to the one provided by ACL SETUSER.
fixFix bug with module GIL being released prematurely (#8061) Could in theory (and rarely) cause multi-threaded modules to corrupt memory.
fixReduce effect of client tracking causing feedback loop in key eviction (#8100)
fixFix cluster access to unaligned memory (SIGBUS on old ARM) (#7958)
fixFix saving of strings larger than 2GB into RDB files (#8306)
featureAvoid wasteful transient memory allocation in certain cases (#8286, #5954)
featureFix crash log registers output on ARM. (#8020)
featureAdd a check for an ARM64 Linux kernel bug (#8224) Due to the potential severity of this issue, Redis will print log warning on startup.
featureRaspberry build fix. (#8095)
featureoom-score-adj-values config can now take absolute values (besides relative ones) (#8046)
fixMoved RMAPI_FUNC_SUPPORTED so that it's usable (#8037)
fixImprove timer accuracy (#7987)
fixAllow '\0' inside of result of RM_CreateStringPrintf (#6260)
otherRedis 6.0.9