Redis 8.0.6 → 8.10.0
32 releases · 1 breaking change · 91 security fixes · 0 advisories fixed
91security1breaking0deprecated83feature243fix
Breaking changes
- breaking Query Engine - LeanVec and LVQ proprietary Intel optimizations were removed from Redis Open Source in 8.2.1
Security changes
- security #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed in 8.8.3
- security #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new… in 8.8.3
- security TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload in 8.8.3
- security Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash in 8.8.3
- security (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write in 8.8.2
- security Out-of-bounds access in TopK heap cleanup path (MOD-15410) in 8.8.2
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 8.8.2
- security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 8.8.2
- security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 8.8.2
- security Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access in 8.8.2
- security Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running in 8.8.2
- security Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays in 8.8.2
- security TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user in 8.8.2
- security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 8.8.2
- security RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution in 8.8.1
- security #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed in 8.6.7
- security #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new… in 8.6.7
- security TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload in 8.6.7
- security Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash in 8.6.7
- security (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write in 8.6.6
- security Out-of-bounds access in TopK heap cleanup path (MOD-15410) in 8.6.6
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 8.6.6
- security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 8.6.6
- security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 8.6.6
- security Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access in 8.6.6
- security Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running in 8.6.6
- security Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays in 8.6.6
- security TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user in 8.6.6
- security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 8.6.6
- security A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution in 8.6.5
- security RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution in 8.6.5
- security (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution in 8.6.3
- security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 8.6.3
- security (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution in 8.6.3
- security (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series) in 8.6.3
- security (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic) in 8.6.3
- security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 8.6.1
- security #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed in 8.4.7
- security #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new… in 8.4.7
- security TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload in 8.4.7
- security Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash in 8.4.7
- security (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write in 8.4.6
- security Out-of-bounds access in TopK heap cleanup path (MOD-15410) in 8.4.6
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 8.4.6
- security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 8.4.6
- security #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity in 8.4.6
- security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 8.4.6
- security Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access in 8.4.6
- security Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running in 8.4.6
- security Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays in 8.4.6
- security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 8.4.6
- security A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution in 8.4.5
- security RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution in 8.4.5
- security (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. in 8.4.3
- security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 8.4.3
- security (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution in 8.4.3
- security (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series) in 8.4.3
- security (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic) in 8.4.3
- security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 8.4.2
- security RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log in 8.4.1
- security RedisBloom/RedisBloom#936 Cuckoo filter: crash on RDB load on 0 buckets (MOD-11593) in 8.4.1
- security RedisBloom/RedisBloom#945 Bloom filter: crash on RDB load on large number of filters (MOD-11590) in 8.4.1
- security #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new… in 8.2.10
- security TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload in 8.2.10
- security Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash in 8.2.10
- security (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write in 8.2.9
- security Out-of-bounds access in TopK heap cleanup path (MOD-15410) in 8.2.9
- security Use-after-free in the TLS pending-data list when a command closes another pending connection in 8.2.9
- security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 8.2.9
- security #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity in 8.2.9
- security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 8.2.9
- security Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access in 8.2.9
- security Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running in 8.2.9
- security Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays in 8.2.9
- security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 8.2.9
- security A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution in 8.2.8
- security RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution in 8.2.8
- security (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. in 8.2.6
- security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 8.2.6
- security (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution in 8.2.6
- security (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series) in 8.2.6
- security (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic) in 8.2.6
- security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 8.2.5
- security RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log in 8.2.4
- security (CVE-2025-62507) XACKDEL - potential stack overflow and RCE in 8.2.3
- security (CVE-2025-49844) A Lua script may lead to remote code execution in 8.2.2
- security (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE in 8.2.2
- security (CVE-2025-46818) A Lua script can be executed in the context of another user in 8.2.2
- security (CVE-2025-46819) LUA out-of-bound read in 8.2.2
- security (CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands in 8.2.0
- security (CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error in 8.2.0
Every release in between
featureCompact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
featureNew command: HIMPORT - high-throughput compact hash bulk insertion
otherTLS peer certificate-based server-to-server authentication
featureNew commands: LMOVEM, BLMOVEM - move multiple elements between lists
featureNew command: SUNIONCARD - get the cardinality of the union of multiple sets
featureNew command: SDIFFCARD - get the cardinality of the difference between sets
featureNew command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
featureXREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
featureNew command: FT.ALIASLIST - get all aliases for the index
featureStemmer support for Malay and Tagalog languages
otherJSONPath extensions
featureNew commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
featureNew command: TS.READ - optionally blocking read
featureNew command: TS.QUERYLABELS - Get a list of labels and label-values
featureNew command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
otherPerformance improvements
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
otherRocky Linux 8.10, 9.7, 10.1
otherAlmaLinux 8.10, 9.7, 10.1
otherDebian 12.13 (Bookworm), Debian 13.4 (Trixie)
otherAlpine 3.23
othermacOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM
fix#15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
fix#15453 Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
fix#15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed
fix#15518 notify modules when node's own ip/port changes
fix#15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
fixRediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)
fixRediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)
fixRediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)
fixRediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)
fixRediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)
fixRediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)
security#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
security#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new…
securityTimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
securityVector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
security(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
securityOut-of-bounds access in TopK heap cleanup path (MOD-15410)
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
securityVector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
securityVector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
securityVector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
securityTLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityRedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
featureNew data structure: Array (@antirez)
otherSubkey notification for hash fields - field-level notifications
otherINCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)
featureXNACK: a new streams command - allow consumers to explicitly release pending messages
featureZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator
featureJSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays
otherTS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command
featureFT.HYBRID KNN clause: new argument to request fewer candidates per shard
featureFT.PROFILE HYBRID: profiling support for FT.HYBRID
otherPerformance improvements
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
otherRocky Linux 8.10, 9.7, 10.1
otherAlmaLinux 8.10, 9.7, 10.1
otherDebian 12.13 (Bookworm), Debian 13.4 (Trixie)
otherAlpine 3.23
othermacOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM
fix#15237 INCREX syntax update
fix#15005 Memory tracking can be enabled at runtime in non-clustered mode
fixRedisTimeSeries/RedisTimeSeries#1930 Cluster topology changes during a multi-shard command are not handled (MOD-14439)
fixRedisBloom/RedisBloom#1007 Memory leak on RDB load (MOD-15418)
security#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
security#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new…
securityTimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
securityVector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
security(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
securityOut-of-bounds access in TopK heap cleanup path (MOD-15410)
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
securityVector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
securityVector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
securityVector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
securityTLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityA crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
securityRedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
fixRedisBloom/RedisBloom#1021 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover
fix#15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
fix#15163 MULTI queue memory incorrect memory accounting
fix#15115 Under-copy in the Lua debugger
fix#15094 Cluster crash when CLIENT KILL unsubscribes SSUBSCRIBE client inside EXEC
fix#14963 XREADGROUP: consumer replication inconsistency
fix#14934 Client output buffer memory tracking not accounting for copy-avoided bulk string references
fix#14970 Sentinel config injection via SENTINEL SET
fix#14982 SCAN commands: integer overflow in COUNT parameter
fix#15073 CLIENT TRACKING: self-overlap returning non-zero loop index
fix#15059 Use-after-free
fix#15037 XINFO STREAM: wrong value in the per-slot memory tracking
fix#15034, #15081 Issues processing corrupt RDB data
fix#15021 HEXPIRE: overflow on fields count
fix#14942 Fix COMMAND GETKEYS for PFMERGE with no source keys
fix#15188 cluster-announce-ip rejecting hostnames (regression)
fix#14667, #14886 Potential TCP stalls/deadlocks
fixRediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
fixRediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)
security(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution
security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
security(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
security(CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
security(CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)
fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
fixCONFIG SET: some settings allow invalid characters (RED-167787)
fixSCRIPT DEBUG: potential crash on scripts (RED-175507)
fixVADD: crash or buffer overflow on large REDUCE value (RED-170921)
fixVSET: crash on huge allocations (MOD-12678)
fixPotential crash on disconnections and TLS failures (Time Series) (MOD-14850)
fixRediSearch/RediSearch#8745 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
fixRediSearch/RediSearch#8848 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
fixRediSearch/RediSearch#8205, RediSearch/RediSearch#8259 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-12370, MOD-13884)
fixRediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty reply (MOD-14778)
fixRediSearch/RediSearch#8129, RediSearch/RediSearch#8140 FT.PROFILE reports an incorrect shard total profile time (MOD-13735, MOD-13181)
fixRediSearch/RediSearch#9047 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
fixRediSearch/RediSearch#8791 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
fixRediSearch/RediSearch#8382 Crash when indexing negative zero (-0.0) (MOD-13904)
fixRediSearch/RediSearch#8590 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
fixRediSearch/RediSearch#8660 FILTER behavior depends on property order in the expression (MOD-14065)
fixRediSearch/RediSearch#8593 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
fixRediSearch/RediSearch#8591 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
fixRediSearch/RediSearch#8589 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14328)
fixRediSearch/RediSearch#9012 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
fixRediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
fixRediSearch/RediSearch#8462 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
fixRediSearch/RediSearch#9066 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)
fixRediSearch/RediSearch#8109, RediSearch/RediSearch#8149 Configuration registration omits module parameters, causing them to be unexposed or misapplied (RED-171841)
fixRediSearch/RediSearch#9163 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
fixRediSearch/RediSearch#8395 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828)
fixRediSearch/RediSearch#8451 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14079)
fixRediSearch/RediSearch#9078 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)
fixRediSearch/RediSearch#8051, RediSearch/RediSearch#8114 Crash diagnostics now include the IndexSpec of the index the failing thread was working on (MOD-7574)
featureRediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)
fix#14824 Potential UAF: don't use reply copy avoidance for module strings
fix#14848 Crash during command processing on replicas performing full synchronization
fix#14794 New XIDMPRECORD internal command and AOFRW emission to restore stream IDMP state
fix#14816 setModuleEnumConfig() passing prefixed name to module callbacks
fix#14858 Streams: Ensures XADD with IDMP/IDMPAUTO that hits an existing IID records the metadata change
fix#14855, #14831, #14817 Potential memory leaks
fix#14869 Streams: IDMP cron expiration not working after RDB load
fix#14847 Potential crash during ACL checks on wrong-arity commands
fix#14883 HSETEX, HGETEX do not validate that FIELDS is specified only once
fix#14897 Streams: IDMP-related bugs
securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
fix#14785 HOTKEYS: The INFO command may display module information, and the missing HOTKEYS HELP subcommand has been added
fix#14789 Bug in RDB loading prevented hash table expansion, increasing load time
otherSubstantial performance improvements
otherSubstantial memory reduction for hashes (hashtable-encoded) and sorted sets (skiplist-encoded)
featureStreams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments
featureNew eviction policies - least recently modified: volatile-lrm and allkeys-lrm
featureHot keys detection and reporting; new command: HOTKEYS
otherTLS certificate-based automatic client authentication
featureTime series: support NaN values; new aggregators: COUNTNAN and COUNTALL
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)
otherRocky Linux 8.10, 9.5
otherAlmaLinux 8.10, 9.5, 10.1
otherDebian 12 (Bookworm), Debian 13 (Trixie)
othermacOS 14 (Sonoma), 15 (Sequoia)
feature#14695 Keys memory size histograms
feature#14714 Optimize user ACL permission verification
feature#14692 Optimize peak memory metric collection
feature#14739 Avoid allocating and releasing list node in reply copy avoidance
feature#14713 Reduce per command syscalls by reusing cached time when hardware monotonic clock is available
feature#14726 Optimize XREADGROUP CLAIM
feature#13962 Vector set: replace manual popcount with __builtin_popcountll for binary vector distance (Intel, AMD, ARM)
feature#14474 Vector set: vectorized the quantized 8-bit vector distance calculation (Intel, AMD)
feature#14492 Vector set: vectorize binary quantization path for vectorsets distance calculation (Intel, AMD)
other#14719 cluster-slot-stats-enabled - per-slot resource consumptions statistics to collect
other#14695 key-memory-histograms collect memory consumption histograms per data type
other#14695 db0_distrib_lists_sizes, db0_distrib_sets_sizes, db0_distrib_hashes_sizes, db0_distrib_zsets_sizes
fixStreams: avoid using XADD with the new IDMP or IDMPAUTO options when using appendonly yes with aof-use-rdb-preamble no (non default). This limitation will be removed in the next patch.
security#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
security#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new…
securityTimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
securityVector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
security(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
securityOut-of-bounds access in TopK heap cleanup path (MOD-15410)
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
security#14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
securityVector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
securityVector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
securityVector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityA crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
securityRedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
fixRedisBloom/RedisBloom#1020 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover
fix#15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
fix#15163 MULTI queue memory incorrect memory accounting
fix#14581 Rare server hang at shutdown
fix#14545 ACL: AOF loading fails if ACL rules are changed and don't allow some commands in MULTI-EXEC
fix#14537 SCAN: restore original filter order (revert change introduced in 8.2)
fix#14816 setModuleEnumConfig() passing prefixed name to module callbacks
fix#14659 ACL: Key-pattern bypass in MSETEX
fix#14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies
fix#14552 Streams: Incorrect behavior when using XDELEX ... ACKED after XGROUP DESTROY
fix#14848 Crash during command processing on replicas performing full synchronization
fix#15188 cluster-announce-ip rejecting hostnames (regression)
fix#14667, #14886 Potential TCP stalls/deadlocks
fixRediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
fixRediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)
security(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
security(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
security(CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
security(CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)
fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
fixCONFIG SET: some settings allow invalid characters (RED-167787)
fixSCRIPT DEBUG: potential crash on scripts (RED-175507)
fixVADD: crash or buffer overflow on large REDUCE value (RED-170921)
fixVSET: crash on huge allocations (MOD-12678)
fixPotential crash on disconnections and TLS failures (Time Series) (MOD-14850)
fixRediSearch/RediSearch#8744 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
fixRediSearch/RediSearch#8849 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
fixRediSearch/RediSearch#8258 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-13885)
fixRediSearch/RediSearch#9183 FT.PROFILE HYBRID returns an empty reply (MOD-14778)
fixRediSearch/RediSearch#9048 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
fixRediSearch/RediSearch#8792 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
fixRediSearch/RediSearch#8384 Crash when indexing negative zero (-0.0) (MOD-13904)
fixRediSearch/RediSearch#8596 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
fixRediSearch/RediSearch#8661 FILTER behavior depends on property order in the expression (MOD-14065)
fixRediSearch/RediSearch#8598 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
fixRediSearch/RediSearch#8597 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
fixRediSearch/RediSearch#8595 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14062)
fixRediSearch/RediSearch#9011 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
fixRediSearch/RediSearch#9080 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
fixRediSearch/RediSearch#8461 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
fixRediSearch/RediSearch#9091 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)
fixRediSearch/RediSearch#9161 Coordinator deadlock under mixed FT.SEARCH and FT.AGGREGATE load (MOD-14268)
fixRediSearch/RediSearch#9165 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
fixRediSearch/RediSearch#8394 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828)
fixRediSearch/RediSearch#8452 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14080)
fixRediSearch/RediSearch#9077 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)
featureRediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)
securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
securityRedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log
securityRedisBloom/RedisBloom#936 Cuckoo filter: crash on RDB load on 0 buckets (MOD-11593)
securityRedisBloom/RedisBloom#945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)
fix#14637 Atomic slot migration: wrong adjacent slot range behavior
fix#14567 Atomic slot migration: support delay trimming slots after finishing migrating slots
fix#14746 CLUSTER SLOT-STATS: Fix few memory tracking bugs
fixRedisTimeSeries/RedisTimeSeries#1864 Atomic slot migration: time series limitations (MOD-13611)
fixRediSearch/RediSearch#6973 Correct empty string token counting in byteOffset calculations to ensure accurate text position tracking (MOD-11233)
fixRediSearch/RediSearch#6995 Prevent FT.INFO command fanout to replicas to reduce unnecessary cluster traffic
fixRediSearch/RediSearch#7154 Display Background Indexing OOM warning in FT.AGGREGATE when memory limits are approached (MOD-11817)
fixRediSearch/RediSearch#7219 Resolve concurrency issue in FT.AGGREGATEreducer that caused intermittent errors (MOD-12243)
fixRediSearch/RediSearch#7255 Correct BM25STD underflow wraparound to prevent incorrect scoring (MOD-12223)
fixRediSearch/RediSearch#7264 Ensure accurate totalDocsLen updates to maintain correct document statistics (MOD-12234)
fixRediSearch/RediSearch#7275 Report used memory as unsigned long to prevent overflow (RED-169833)
fixRediSearch/RediSearch#7350 FT.CREATE with LeanVec parameters on non-Intel architectures (RED-176382)
fixRediSearch/RediSearch#7371 Validate search-min-operation-workers min value correctly (MOD-12383)
fixRediSearch/RediSearch#7430 Prevent coordinator deadlock in FT.HYBRID queries by avoiding index read lock (MOD-12489)
fixRediSearch/RediSearch#7435 Ensure full profile output on timeout with RETURN policy in FT.PROFILE (MOD-12320)
featureRediSearch/RediSearch#7496 Vector search performance improvements (MOD-12011, MOD-12063, MOD-12629, MOD-12346)
featureRediSearch/RediSearch#7519 Reduce number of worker threads asynchronously to improve resource utilization (MOD-12252, MOD-11658)
featureRediSearch/RediSearch#7694 Use asynchronous jobs in GC for SVS to reduce blocking (MOD-12668)
featureRediSearch/RediSearch#7730 Support filter_policy and batch_size parameters for vector similarity search tuning (MOD-13007, MOD-12371)
featureRediSearch/RediSearch#7782 Resolve SVS GC failures when worker threads are disabled (MOD-12983)
featureRediSearch/RediSearch#7572 Implement ASM state machine on notifications (MOD-12170)
featureRediSearch/RediSearch#7829 ASM-aware search flow for Active-Active deployments (MOD-12171, MOD-12169)
featureRediSearch/RediSearch#7589 Support multiple slot ranges in search.CLUSTERSET for flexible cluster topology updates (MOD-11657)
featureRediSearch/RediSearch#7862 Support subquery count in FT.HYBRID (MOD-11858, MOD-13146)
featureRediSearch/RediSearch#7893 Request policy support for cursor operations (MOD-13146, MOD-9573, MOD-8104)
featureRediSearch/RediSearch#8087 Warning when cursor may give inaccurate results due to Active-Active replication (MOD-12899)
featureRediSearch/RediSearch#7445 Remove outdated validation from Debug Aggregate in cluster mode (MOD-12435)
featureRediSearch/RediSearch#7384 Reduce index load from RDB temporary memory overhead (MOD-12212)
featureRediSearch/RediSearch#7573 Debug support for FT.PROFILE command (MOD-12627)
featureRediSearch/RediSearch#7736 Add Internal cursor reads metric to cluster FT.PROFILE output (MOD-12414)
featureRediSearch/RediSearch#7552 Add active_io_threads metric (MOD-12069, MOD-12695)
featureRediSearch/RediSearch#7622 Add active_coord_threads metric (MOD-12694, MOD-12069)
featureRediSearch/RediSearch#7564 Add active_worker_threads metric (MOD-12694, MOD-12069)
featureRediSearch/RediSearch#7626 Add *_pending_jobs metrics for job queues (MOD-12069)
featureRediSearch/RediSearch#7658 Add pending workers admin jobs metric (MOD-12069, MOD-12791)
featureRediSearch/RediSearch#7731 Add active_topology_update_threads metric (MOD-12069, MOD-12790)
featureRediSearch/RediSearch#7083 Add default scorer configuration option (MOD-10037)
+44 more items in the release notesotherDIGEST, DELEX; SET extensions - atomic compare-and-set and compare-and-delete for string keys
otherMSETEX - atomically set multiple string keys and update their expiration
featureXREADGROUP - new CLAIM option for reading both idle pending and incoming stream entries
otherCLUSTER MIGRATION - atomic slot migration
otherCLUSTER SLOT-STATS - per-slot usage metrics: key count, CPU time, and network I/O
otherRedis query engine: FT.HYBRID - hybrid search and fused scoring
otherRedis query engine: I/O threading with performance boost for search and query commands (FT.*)
otherI/O threading: substantial throughput increase (e.g. >30% for caching use cases (10% SET, 90% GET), 4 cores)
otherJSON: substantial memory reduction for homogenous arrays (up to 92%)
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)
otherRocky Linux 8.10, 9.5
otherAlmaLinux 8.10, 9.5
otherDebian 12 (Bookworm), Debian 13 (Trixie)
othermacOS 13 (Ventura), 14 (Sonoma), 15 (Sequoia)
fix#14524 XREADGROUP CLAIM returns strings instead of integers
fix#14529 Add variable key-spec flags to SET IF* and DELEX
fix#P928 Potential memory leak (MOD-11484)
fix#T1801, #T1805 macOS build failures (MOD-12293)
fix#J1438 JSON.NUMINCRBY - wrong result on integer array with non-integer increment (MOD-12282)
fix#J1437 Thread safety issue related to ASM and shared strings (MOD-12013)
feature#14480, #14516 Optimize XREADGROUP
fixWhen executing FT.SEARCH, FT.AGGREGATE, FT.CURSOR, FT.HYBRID, TS.MGET, TS.MRANGE, TS.MREVRANGE, and TS.QUERYINDEX while an atomic slot migration process is in progress, the results may be partial or contain duplicates
fixFT.PROFILE, FT.EXPLAIN, and FT.EXPLACINCLI do not contain the FT.HYBRID option
fixMetrics from FT.HYBRID command are not displayed on FT.INFO and INFO
fixFT.HYBRID: the EXPLAINSCORE, SHARD_K_RATIO, YIELD_DISTANCE_AS, and WITHCURSOR options are not supported
fixFT.HYBRID: post-filtering (after COMBINE step) using FILTER is not supported
fixFT.HYBRID: the default response format considers only key_id and score. This may change for delivering the entire document content
security#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new…
securityTimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
securityVector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash
security(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
securityOut-of-bounds access in TopK heap cleanup path (MOD-15410)
securityUse-after-free in the TLS pending-data list when a command closes another pending connection
security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
security#14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
securityVector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
securityVector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
securityVector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
securityA crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
securityRedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
fixRedisBloom/RedisBloom#1019 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover
fix#15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
fix#14537 SCAN: restore original filter order (revert change introduced in 8.2)
fix#14816 setModuleEnumConfig() passing prefixed name to module callbacks
fix#14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies
fix#14552 Streams: Incorrect behavior when using XDELEX...ACKED after XGROUP DESTROY`
fix#14420 Shutdown blocked client not being properly reset after shutdown cancellation
fix#14415 Potential crash in lookupKey() when executing_client is NULL
fix#14417 CLUSTER FORGET - heap-buffer-overflow
fix#15188 cluster-announce-ip rejecting hostnames (regression)
fix#14667, #14886 Potential TCP stalls/deadlocks
fixRediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
fixRediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)
security(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
security(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
security(CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
security(CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)
fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
fixCONFIG SET: some settings allow invalid characters (RED-167787)
fixSCRIPT DEBUG: potential crash on scripts (RED-175507)
fixVADD: crash or buffer overflow on large REDUCE value (RED-170921)
fixVSET: crash on huge allocations (MOD-12678)
fixPotential crash on disconnections and TLS failures (Time Series) (MOD-14850)
fixRediSearch/RediSearch#8743 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
fixRediSearch/RediSearch#8850 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
fixRediSearch/RediSearch#9178 Coordinator deadlock under mixed FT.SEARCH and FT.AGGREGATE load (MOD-14268)
fixRediSearch/RediSearch#9049 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
fixRediSearch/RediSearch#8793 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
fixRediSearch/RediSearch#8600 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
fixRediSearch/RediSearch#8662 FILTER behavior depends on property order in the expression (MOD-14342)
fixRediSearch/RediSearch#8602 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
fixRediSearch/RediSearch#8601 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
fixRediSearch/RediSearch#8599 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14062)
fixRediSearch/RediSearch#9019 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
fixRediSearch/RediSearch#9081 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
fixRediSearch/RediSearch#8464 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
fixRediSearch/RediSearch#8888 FT.CURSOR enters an infinite loop when the ACL user lacks specific permissions (MOD-14479)
fixRediSearch/RediSearch#9166 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
fixRediSearch/RediSearch#8453 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14081)
fixRediSearch/RediSearch#9076 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)
featureRediSearch/RediSearch#8235 FT.PROFILE: added queue time tracking (MOD-13602)
securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
securityRedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log
fixRedisJSON/RedisJSON#1430 Malformed panic log messages (MOD-9365)
fixRedisBloom/RedisBloom#945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)
fixRediSearch/RediSearch#6973 Correct empty string token counting in byteOffset calculations to ensure accurate text position tracking (MOD-11233)
fixRediSearch/RediSearch#6995 Prevent FT.INFO command fanout to replicas to reduce unnecessary cluster traffic
fixRediSearch/RediSearch#7034 Correct goto statement handling on RDB load
fixRediSearch/RediSearch#7154 Display Background Indexing OOM warning in FT.AGGREGATE when memory limits are approached (MOD-11817)
fixRediSearch/RediSearch#7219 Resolve concurrency issue in Reducer that caused intermittent errors (MOD-12243)
fixRediSearch/RediSearch#7255 Correct BM25STD underflow wraparound to prevent incorrect scoring (MOD-12223)
fixRediSearch/RediSearch#7264 Ensure accurate totalDocsLen updates to maintain correct document statistics (MOD-12234)
fixRediSearch/RediSearch#7275 Report used memory as unsigned long to prevent overflow (RED-169833)
fixRediSearch/RediSearch#7350 Allow FT.CREATE with LeanVec parameters on non-Intel architectures (RED-176382)
fixRediSearch/RediSearch#7384 Reduce index load from RDB temporary memory overhead (MOD-12212)
fixRediSearch/RediSearch#7435 Ensure full profile output on timeout with RETURN policy in FT.PROFILE (MOD-12320)
fixRediSearch/RediSearch#7446 Remove outdated validation from debug aggregate in cluster mode (MOD-12435)
fixRediSearch/RediSearch#7458 Correct GC regression that caused stability issues (MOD-12538)
fixRediSearch/RediSearch#7459 Prevent potential double-free in Fork GC error path (MOD-12521)
fixRediSearch/RediSearch#7470 Remove draining from Flush callback to avoid blocking
fixRediSearch/RediSearch#7499 Propagate HGETALL command in HDT mode (MOD-12662)
fixRediSearch/RediSearch#7534 Reduce number of worker threads asynchronously to prevent performance degradation (MOD-12252, MOD-11658)
fixRediSearch/RediSearch#7554 Handle Coordinator case when SCORE is sent alone without extra fields (MOD-12647)
fixRediSearch/RediSearch#7561 Prevent memory corruption when freeing searchRequestCtx on error (MOD-12699)
fixRediSearch/RediSearch#7685 Resolve cursor logical leak that could lead to resource exhaustion (MOD-12807)
fixRediSearch/RediSearch#7710 Add support for WITHCOUNT in FT.AGGREGATE (MOD-11751)
fixRediSearch/RediSearch#7794 Correctly handle binary data with embedded NULLs to prevent crashes (MOD-13010)
fixRediSearch/RediSearch#7812 Correct SVS GC for no-workers case (MOD-12983)
fixRediSearch/RediSearch#7873 Handle warnings in empty FT.AGGREGATE replies in cluster mode (MOD-12640)
fixRediSearch/RediSearch#7886 Remove non-TEXT fields from spec's keys dictionary to prevent incorrect field handling (MOD-13150)
fixRediSearch/RediSearch#7901 Support multiple warnings in reply to prevent warning loss (MOD-13252)
fixRediSearch/RediSearch#8083 Correct FULLTEXT field metric count accuracy (MOD-13432)
featureRediSearch/RediSearch#7496 Vector search performance improvements (MOD-12011, MOD-12063, MOD-12629, MOD-12346)
featureRediSearch/RediSearch#7694 Use asynchronous jobs in GC for SVS to reduce blocking (MOD-12668)
featureRediSearch/RediSearch#7737 Add Internal cursor reads metric to cluster FT.PROFILE output (MOD-12414)
featureRediSearch/RediSearch#7552 Add active_io_threads metric (MOD-12069, MOD-12695)
featureRediSearch/RediSearch#7564 Add active_worker_threads metric (MOD-12694, MOD-12069)
featureRediSearch/RediSearch#7623 Add active_coord_threads metric (MOD-12694, MOD-12069)
featureRediSearch/RediSearch#7626 Add *_pending_jobs metrics for job queues (MOD-12069)
featureRediSearch/RediSearch#7672 Add pending workers admin jobs metric (MOD-12069, MOD-12791)
featureRediSearch/RediSearch#7732 Introduce active_topology_update_threads metric (MOD-12069, MOD-12790)
featureRediSearch/RediSearch#7083 Add default scorer configuration option (MOD-10037)
+12 more items in the release notessecurity(CVE-2025-62507) XACKDEL - potential stack overflow and RCE
fixHGETEX - potential crash when FIELDS is used and numfields is missing
fixPotential crash on HyperLogLog with 2GB+ entries
fixCuckoo filter - Division by zero in Cuckoo filter insertion
fixCuckoo filter - Counter overflow
fixBloom filter - Arbitrary memory read/write with invalid filter
fixBloom filter - Out-of-bounds access with empty chain
fixBloom filter - Restore invalid filter [We thank AWS security for responsibly disclosing this security bug]
fixTop-k - Out-of-bounds access
security(CVE-2025-49844) A Lua script may lead to remote code execution
security(CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
security(CVE-2025-46818) A Lua script can be executed in the context of another user
security(CVE-2025-46819) LUA out-of-bound read
feature#14223 VSIM: new EPSILON argument to specify maximum distance
feature#Q6867 SVS-VAMANA: allow use of BUILD_INTEL_SVS_OPT flag for Intel optimisations (MOD-10920)
fix#14319 Potential crash on Lua script defrag
fix#14323 Potential crash on streams and HFE defrag
fix#14330 Potential use-after-free after pubsub and Lua defrag
fix#14288 MEMORY USAGE: fix reported value
fix#14259 XGROUP CREATE, XGROUP SETID: limit ENTRIESREAD value to the number of entries added to the stream
fix#J1374 JSON.DEL doesn’t delete all matching object members / array elements (MOD-11032, MOD-11067)
fix#P886 TDIGEST.CREATE crashes (OOM) on huge initialization values (MOD-10840)
fix#Q6787 Potential shard restart while reindexing vectors on RDB loading (MOD-11011)
fix#Q6676 Potential crash when using small CONSTRUCTION_WINDOW_SIZE on SVS-VAMANA (MOD-10771)
fix#Q6701 Potential crash (OOM) in heavy updates due to a file descriptor leak (MOD-10975)
fix#Q6723 Potential crash when using ACL rules (MOD-10748)
fix#Q6641 INFO SEARCH: search_used_memory_indexes vector index memory value incorrect
fix#Q6665 FT.PROFILE: more accurate execution duration measurements (MOD-10622)
other#Q6648 Improve RESP3 serialization performance (MOD-9687)
feature#Q6671 INFO SEARCH: new SVS-VAMANA metrics
fix#14240 INFO KEYSIZES - potential incorrect histogram updates on cluster mode with modules
fix#14274 Disable Active Defrag during flushing replica
fix#14276 XADD and XTRIM can crash the server after loading an RDB
fix#Q6601 Potential crash when running FLUSHDB (MOD-10681)
breakingQuery Engine - LeanVec and LVQ proprietary Intel optimizations were removed from Redis Open Source
fix#Q6621 Fix regression in INFO (MOD-10779)
featureStreams - new commands: XDELEX and XACKDEL; extension to XADD and XTRIM
featureBitmap - BITOP: new operators: DIFF, DIFF1, ANDOR, and ONE
featureQuery Engine - new SVS-VAMANA vector index type which supports vector compression
otherMore than 15 performance and resource utilization improvements
featureNew metrics: per-slot usage metrics, key size distributions for basic data types, and more
otherAlpine and Debian Docker images - https://hub.docker.com/_/redis
otherInstall using snap - see https://github.com/redis/redis-snap
otherInstall using brew - see https://github.com/redis/homebrew-redis
otherInstall using RPM - see https://github.com/redis/redis-rpm
otherInstall using Debian APT - see https://github.com/redis/redis-debian
otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)
otherRocky Linux 8.10, 9.5
otherAlmaLinux 8.10, 9.5
otherDebian 12 (Bookworm)
othermacOS 13 (Ventura), 14 (Sonoma), 15 (Sequoia)
security(CVE-2025-32023) Fix out-of-bounds write in HyperLogLog commands
security(CVE-2025-48367) Retry accepting other connections even if the accepted connection reports an error
feature#14141 Keyspace notifications - new event types:
featureOVERWRITTEN - the value of a key is completely overwritten
featureTYPE_CHANGED - key type change
fix#14162 Crash when using evport with I/O threads
fix#14163 EVAL crash when error table is empty
fix#14144 Vector sets - RDB format is not compatible with big endian machines
fix#14165 Endless client blocking for blocking commands
fix#14164 Prevent CLIENT UNBLOCK from unblocking CLIENT PAUSE
fix#14216 TTL was not removed by the SET command
fix#14224 HINCRBYFLOAT removes field expiration on replica
feature#Q6430 More compression variants for the SVS-VAMANA vector index
feature#Q6535 SHARD_K_RATIO parameter - favor network latency over accuracy for KNN vector query in a Redis cluster (unstable feature) (MOD-10359)
feature#14144 Vector set - improve RDB loading / RESTORE speed by storing the worst link info
feature#14051 RedisModule_Get*, RedisModule_Set* - allow modules to access Redis configurations
other#14114 RM_UnsubscribeFromKeyspaceEvents - unregister a module from specific keyspace notifications