Expose a best-effort AOF replay-time estimate in INFO persistence so operators can gauge reload RTO. Count time only for writes that enter the AOF, credit leftover call() time to synthetic rewrites, and skip the bookkeeping when AOF is off.
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection A malicious RDB payload with an out-of-range SLOT_INFO slot id causes me…
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER an…
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER an…
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER an…
Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the…
Update urgency: SECURITY: There are security fixes in the release. Security fixes Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses #14847 Out-of-bounds argv access during key extrac…
Update urgency: SECURITY: There are security fixes in the release. Security fixes Use-after-free in the TLS pending-data list when a command closes another pending connection ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses Out-of-bounds argv access during key extraction when chec…
Update urgency: SECURITY: There is a security fix in the release. Security fixes Use-after-free in the TLS pending-data list when a command closes another pending connection
This is the first Release Candidate of Redis 8.10 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. Headlines: Redis 8.10 introduces new features and performance improvements. Operating systems we test Redis 8.10 on Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon) Rocky Linux 8.10, 9.7, 10.1 A…
This is the General Availability release of Redis 8.10 in Redis Open Source. Major changes compared to 8.8 Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema New command: HIMPORT - high-throughput compact hash bulk insertion TLS peer certificate-based server-to-server authentication New commands: LMOVEM, BLMOVEM - move…
SECURITY: There are security fixes in the release. Security fixes A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution Bug fixes RedisBloom/RedisBloom…
SECURITY: There are security fixes in the release. Security fixes A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution Bug fixes RedisBloom/RedisBloom…
SECURITY: There is a security fix in the release. Security fixes RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
SECURITY: There are security fixes in the release. Security fixes A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution Bug fixes RedisBloom/RedisBloom…
Update urgency: SECURITY: There is a security fix in the release. Security fixes A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
Update urgency: SECURITY: There is a security fix in the release. Security fixes A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
Update urgency: SECURITY: There is a security fix in the release. Security fixes A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
This is the second Release Candidate of Redis 8.10 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. Bug fixes (compared to 8.10-RC1) A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply A typo in release.h that could cause build failures
Bumps the bundled RedisTimeSeries pin in modules/modules.yaml from v8.9.82 to v8.9.90. Manifest-only change; loadmodule path and build settings unchanged. RediSearch/RedisJSON/RedisBloom are untouched here. Changelog RedisTimeSeries v8.9.82...v8.9.90 MOD-16382 Handle cluster topology-change notifications — auto-refresh the cluster view on the topology-change event (replaces manual TIMESERIES.REFRE…
For a new key, RESTORE REPLACE did three dict lookups (find, delete, add). It now reuses the link from the first lookup for the insert and skips the delete when no key is present, so it does a single lookup. The impact is more visible while the dict is rehashing: three lookups would trigger three incremental rehash steps instead of one. A similar optimization could be applied to the non-REPLACE pa…
Updates the bundled RediSearch module version used by Redis module builds from v8.9.80 to v8.9.81. This picks up the tagged RediSearch 8.9.81 release for the 8.10 MS2 milestone. Validation: Checked that v8.9.81 exists in RediSearch/RediSearch and resolves to ccfdde4eb4444049f5965c4aa69a97d9a23a8cf2. Checked the diff is limited to modules/redisearch/Makefile. Ran git diff --check. NoteLow Risk Sing…
Update urgency: HIGH: There are critical bugs that may affect a subset of users. Bug fixes #15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64 #15163 MULTI queue memory incorrect memory accounting #14581 Rare server hang at shutdown #14545 ACL: AOF loading fails if ACL rules are changed and don't allow some commands in MULTI-EXEC #14537 SCAN: restore original filter order (revert ch…
This is the General Availability release of Redis 8.8 in Redis Open Source. Major changes compared to 8.6 New data structure: Array (@antirez) Subkey notification for hash fields - field-level notifications INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team) XNACK: a new streams command - allow consumers to explicitly release…
Jira: https://redislabs.atlassian.net/browse/MOD-16291 Updates the bundled RediSearch module version used by Redis module builds from v8.8.0 to v8.9.80. This picks up the tagged RediSearch 8.9.80 release. Validation: Checked that v8.9.80 exists in RediSearch/RediSearch and resolves to 280c3ce1bd65fd7306cae75a1d54bce3a05518e4. Checked the diff is limited to modules/redisearch/Makefile. Ran git diff…
Update urgency: HIGH: There are critical bugs that may affect a subset of users. Bug fixes #15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64 #15163 MULTI queue memory incorrect memory accounting #15115 Under-copy in the Lua debugger #15094 Cluster crash when CLIENT KILL unsubscribes SSUBSCRIBE client inside EXEC #14963 XREADGROUP: consumer replication inconsistency #14934 Client o…
Update urgency: HIGH: There are critical bugs that may affect a subset of users. Bug fixes #15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64 #14537 SCAN: restore original filter order (revert change introduced in 8.2) #14816 setModuleEnumConfig() passing prefixed name to module callbacks #14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategi…
This is the first Release Candidate of Redis 8.8 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. Headlines: Redis 8.8 introduces new features and performance improvements. Operating systems we test Redis 8.8 on Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon) Rocky Linux 8.10, 9.7, 10.1 Alma…
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code E…
Update urgency: SECURITY: There are security fixes in the release. Security fixes (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code…