Redis 8.6.7 → 8.10.0

5 releases · 0 breaking changes · 15 security fixes · 0 advisories fixed

15security0breaking0deprecated19feature15fix

Is 8.6.7 affected? · What changed up to 8.10.2

Breaking changes

None in the release notes.

Security changes

security #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed in 8.8.3
security #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new… in 8.8.3
security TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload in 8.8.3
security Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash in 8.8.3
security (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write in 8.8.2
security Out-of-bounds access in TopK heap cleanup path (MOD-15410) in 8.8.2
security Use-after-free in the TLS pending-data list when a command closes another pending connection in 8.8.2
security #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses in 8.8.2
security A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution in 8.8.2
security Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access in 8.8.2
security Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running in 8.8.2
security Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays in 8.8.2
security TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user in 8.8.2
security #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key in 8.8.2
security RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution in 8.8.1

Every release in between

8.10.0 Jul 29, 2026 Release notes ↗

featureCompact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema

featureNew command: HIMPORT - high-throughput compact hash bulk insertion

otherTLS peer certificate-based server-to-server authentication

featureNew commands: LMOVEM, BLMOVEM - move multiple elements between lists

featureNew command: SUNIONCARD - get the cardinality of the union of multiple sets

featureNew command: SDIFFCARD - get the cardinality of the difference between sets

featureNew command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)

featureXREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size

featureNew command: FT.ALIASLIST - get all aliases for the index

featureStemmer support for Malay and Tagalog languages

otherJSONPath extensions

featureNew commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp

featureNew command: TS.READ - optionally blocking read

featureNew command: TS.QUERYLABELS - Get a list of labels and label-values

featureNew command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples

otherPerformance improvements

otherAlpine and Debian Docker images - https://hub.docker.com/_/redis

otherInstall using snap - see https://github.com/redis/redis-snap

otherInstall using brew - see https://github.com/redis/homebrew-redis

otherInstall using RPM - see https://github.com/redis/redis-rpm

otherInstall using Debian APT - see https://github.com/redis/redis-debian

otherUbuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)

otherRocky Linux 8.10, 9.7, 10.1

otherAlmaLinux 8.10, 9.7, 10.1

otherDebian 12.13 (Bookworm), Debian 13.4 (Trixie)

otherAlpine 3.23

othermacOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

fix#15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value

fix#15453 Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list

fix#15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed

fix#15518 notify modules when node's own ip/port changes

fix#15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled

fixRediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)

fixRediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)

fixRediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)

fixRediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)

fixRediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)

fixRediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)

8.8.3 Sep 17, 2026 Release notes ↗

security#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed

security#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new…

securityTimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload

securityVector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

8.8.2 Aug 17, 2026 Release notes ↗

security(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write

securityOut-of-bounds access in TopK heap cleanup path (MOD-15410)

securityUse-after-free in the TLS pending-data list when a command closes another pending connection

security#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses

securityA malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution

securityVector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access

securityVector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running

securityVector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays

securityTLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user

security#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

8.8.1 Jul 23, 2026 Release notes ↗

securityRedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

8.8.0 May 25, 2026 Release notes ↗

featureNew data structure: Array (@antirez)

otherSubkey notification for hash fields - field-level notifications

otherINCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)

featureXNACK: a new streams command - allow consumers to explicitly release pending messages

featureZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator

featureJSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays

otherTS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command

featureFT.HYBRID KNN clause: new argument to request fewer candidates per shard

featureFT.PROFILE HYBRID: profiling support for FT.HYBRID