Redis 8.4.8 → 8.6.4

5 releases · 0 breaking changes · 6 security fixes · 0 advisories fixed

6security0breaking0deprecated14feature60fix

Is 8.4.8 affected? · What changed up to 8.10.3

Breaking changes

None in the release notes.

Security changes

security (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution in 8.6.3
security (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution in 8.6.3
security (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution in 8.6.3
security (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series) in 8.6.3
security (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic) in 8.6.3
security A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply in 8.6.1

Every release in between

8.6.4 Jun 4, 2026 Release notes ↗

fix#15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64

fix#15163 MULTI queue memory incorrect memory accounting

fix#15115 Under-copy in the Lua debugger

fix#15094 Cluster crash when CLIENT KILL unsubscribes SSUBSCRIBE client inside EXEC

fix#14963 XREADGROUP: consumer replication inconsistency

fix#14934 Client output buffer memory tracking not accounting for copy-avoided bulk string references

fix#14970 Sentinel config injection via SENTINEL SET

fix#14982 SCAN commands: integer overflow in COUNT parameter

fix#15073 CLIENT TRACKING: self-overlap returning non-zero loop index

fix#15059 Use-after-free

fix#15037 XINFO STREAM: wrong value in the per-slot memory tracking

fix#15034, #15081 Issues processing corrupt RDB data

fix#15021 HEXPIRE: overflow on fields count

fix#14942 Fix COMMAND GETKEYS for PFMERGE with no source keys

fix#15188 cluster-announce-ip rejecting hostnames (regression)

fix#14667, #14886 Potential TCP stalls/deadlocks

fixRediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)

fixRediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)

8.6.3 May 5, 2026 Release notes ↗

security(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution

security(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution

security(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution

security(CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)

security(CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)

fixSUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)

fixCONFIG SET: some settings allow invalid characters (RED-167787)

fixSCRIPT DEBUG: potential crash on scripts (RED-175507)

fixVADD: crash or buffer overflow on large REDUCE value (RED-170921)

fixVSET: crash on huge allocations (MOD-12678)

fixPotential crash on disconnections and TLS failures (Time Series) (MOD-14850)

fixRediSearch/RediSearch#8745 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)

fixRediSearch/RediSearch#8848 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)

fixRediSearch/RediSearch#8205, RediSearch/RediSearch#8259 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-12370, MOD-13884)

fixRediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty reply (MOD-14778)

fixRediSearch/RediSearch#8129, RediSearch/RediSearch#8140 FT.PROFILE reports an incorrect shard total profile time (MOD-13735, MOD-13181)

fixRediSearch/RediSearch#9047 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)

fixRediSearch/RediSearch#8791 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)

fixRediSearch/RediSearch#8382 Crash when indexing negative zero (-0.0) (MOD-13904)

fixRediSearch/RediSearch#8590 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)

fixRediSearch/RediSearch#8660 FILTER behavior depends on property order in the expression (MOD-14065)

fixRediSearch/RediSearch#8593 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)

fixRediSearch/RediSearch#8591 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)

fixRediSearch/RediSearch#8589 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14328)

fixRediSearch/RediSearch#9012 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)

fixRediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)

fixRediSearch/RediSearch#8462 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)

fixRediSearch/RediSearch#9066 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)

fixRediSearch/RediSearch#8109, RediSearch/RediSearch#8149 Configuration registration omits module parameters, causing them to be unexposed or misapplied (RED-171841)

fixRediSearch/RediSearch#9163 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)

fixRediSearch/RediSearch#8395 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828)

fixRediSearch/RediSearch#8451 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14079)

fixRediSearch/RediSearch#9078 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)

fixRediSearch/RediSearch#8051, RediSearch/RediSearch#8114 Crash diagnostics now include the IndexSpec of the index the failing thread was working on (MOD-7574)

featureRediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)

8.6.2 Mar 24, 2026 Release notes ↗

fix#14824 Potential UAF: don't use reply copy avoidance for module strings

fix#14848 Crash during command processing on replicas performing full synchronization

fix#14794 New XIDMPRECORD internal command and AOFRW emission to restore stream IDMP state

fix#14816 setModuleEnumConfig() passing prefixed name to module callbacks

fix#14858 Streams: Ensures XADD with IDMP/IDMPAUTO that hits an existing IID records the metadata change

fix#14855, #14831, #14817 Potential memory leaks

fix#14869 Streams: IDMP cron expiration not working after RDB load

fix#14847 Potential crash during ACL checks on wrong-arity commands

fix#14883 HSETEX, HGETEX do not validate that FIELDS is specified only once

fix#14897 Streams: IDMP-related bugs

8.6.1 Feb 23, 2026 Release notes ↗

securityA user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

fix#14785 HOTKEYS: The INFO command may display module information, and the missing HOTKEYS HELP subcommand has been added

fix#14789 Bug in RDB loading prevented hash table expansion, increasing load time

8.6.0 Feb 10, 2026 Release notes ↗

otherSubstantial performance improvements

otherSubstantial memory reduction for hashes (hashtable-encoded) and sorted sets (skiplist-encoded)

featureStreams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments

featureNew eviction policies - least recently modified: volatile-lrm and allkeys-lrm

featureHot keys detection and reporting; new command: HOTKEYS

otherTLS certificate-based automatic client authentication

featureTime series: support NaN values; new aggregators: COUNTNAN and COUNTALL

otherAlpine and Debian Docker images - https://hub.docker.com/_/redis

otherInstall using snap - see https://github.com/redis/redis-snap

otherInstall using brew - see https://github.com/redis/homebrew-redis

otherInstall using RPM - see https://github.com/redis/redis-rpm

otherInstall using Debian APT - see https://github.com/redis/redis-debian

otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)

otherRocky Linux 8.10, 9.5

otherAlmaLinux 8.10, 9.5, 10.1

otherDebian 12 (Bookworm), Debian 13 (Trixie)

othermacOS 14 (Sonoma), 15 (Sequoia)

feature#14695 Keys memory size histograms

feature#14714 Optimize user ACL permission verification

feature#14692 Optimize peak memory metric collection

feature#14739 Avoid allocating and releasing list node in reply copy avoidance

feature#14713 Reduce per command syscalls by reusing cached time when hardware monotonic clock is available

feature#14726 Optimize XREADGROUP CLAIM

feature#13962 Vector set: replace manual popcount with __builtin_popcountll for binary vector distance (Intel, AMD, ARM)

feature#14474 Vector set: vectorized the quantized 8-bit vector distance calculation (Intel, AMD)

feature#14492 Vector set: vectorize binary quantization path for vectorsets distance calculation (Intel, AMD)

other#14719 cluster-slot-stats-enabled - per-slot resource consumptions statistics to collect

other#14695 key-memory-histograms collect memory consumption histograms per data type

other#14695 db0_distrib_lists_sizes, db0_distrib_sets_sizes, db0_distrib_hashes_sizes, db0_distrib_zsets_sizes

fixStreams: avoid using XADD with the new IDMP or IDMPAUTO options when using appendonly yes with aof-use-rdb-preamble no (non default). This limitation will be removed in the next patch.