This is the second Release Candidate of Redis 8.12 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. New Features #16082 Update the Search module to include all RedisSearch-related content that was intended for RC1
This is the first Release Candidate of Redis 8.12 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. Headlines: Redis 8.12 introduces new features and performance improvements. Operating systems we test Redis 8.12 on Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon) Rocky Linux 8.10, 9.7, 10.1 A…
Update urgency: SECURITY: There is a security fix in the release. Security fixes Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
Update urgency: SECURITY: There is a security fix in the release. Security fixes Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
Update urgency: SECURITY: There is a security fix in the release. Security fixes Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
Update urgency: SECURITY: There is a security fix in the release. Security fixes Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
Update urgency: SECURITY: There is a security fix in the release. Security fixes Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
Update urgency: SECURITY: There is a security fix in the release. Security fixes Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
Update urgency: SECURITY: There is a security fix in the release. Security fixes Heap buffer overflow when propagating a PUBLISH/SPUBLISH message larger than 4GB over the cluster bus in cluster mode
A hung test run tells us almost nothing today. When no client has made progress for --timeout seconds, test_server_cron prints the clients' last reported state, SIGKILLs every server via force_kill_all_servers and exits; --dump-logs only fires for a failed or excepted test, never for a timeout. So a 20-minute hang costs a whole CI run and produces a few lines. Collect the evidence before tearing t…
Update urgency: SECURITY: There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A c…
Update urgency: SECURITY: There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A c…
Update urgency: SECURITY: There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A c…
Update urgency: SECURITY: There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A c…
Update urgency: SECURITY: There are security fixes in the release. Security fixes #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default…
Expose a best-effort AOF replay-time estimate in INFO persistence so operators can gauge reload RTO. Count time only for writes that enter the AOF, credit leftover call() time to synthetic rewrites, and skip the bookkeeping when AOF is off.
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection A malicious RDB payload with an out-of-range SLOT_INFO slot id causes me…
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER an…
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER an…
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER an…
Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the…
Update urgency: SECURITY: There are security fixes in the release. Security fixes Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses #14847 Out-of-bounds argv access during key extrac…
Update urgency: SECURITY: There are security fixes in the release. Security fixes Use-after-free in the TLS pending-data list when a command closes another pending connection ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses Out-of-bounds argv access during key extraction when chec…
Update urgency: SECURITY: There is a security fix in the release. Security fixes Use-after-free in the TLS pending-data list when a command closes another pending connection
This is the first Release Candidate of Redis 8.10 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. Headlines: Redis 8.10 introduces new features and performance improvements. Operating systems we test Redis 8.10 on Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon) Rocky Linux 8.10, 9.7, 10.1 A…
This is the General Availability release of Redis 8.10 in Redis Open Source. Major changes compared to 8.8 Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema New command: HIMPORT - high-throughput compact hash bulk insertion TLS peer certificate-based server-to-server authentication New commands: LMOVEM, BLMOVEM - move…
SECURITY: There are security fixes in the release. Security fixes A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution Bug fixes RedisBloom/RedisBloom…
SECURITY: There are security fixes in the release. Security fixes A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution Bug fixes RedisBloom/RedisBloom…
SECURITY: There is a security fix in the release. Security fixes RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
SECURITY: There are security fixes in the release. Security fixes A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution Bug fixes RedisBloom/RedisBloom…