Redis Release Notes

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Original source

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Original source

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write

Out-of-bounds access in TopK heap cleanup path (MOD-15410)

Use-after-free in the TLS pending-data list when a command closes another pending connection

#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses

A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution

Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access

Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running

Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays

TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user

#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Original source

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write

Out-of-bounds access in TopK heap cleanup path (MOD-15410)

Use-after-free in the TLS pending-data list when a command closes another pending connection

#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses

#14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity

A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution

Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access

Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running

Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays

#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Original source

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Original source

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Original source

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Original source

Database-scoped management roles. Data path command auditing.

Redis Software version 8.2 is now available!

Highlights

This version offers:

• Database-scoped management roles
• Data path command auditing
• FIPS 140-3 support

Detailed release notes

For more detailed release notes, select a build version from the following table:

Version (Release date) | Major changes | Redis Open Source compatibility
8.2.0-46 (August 2026) | Bug fixes for internal certificate rotation, rolling upgrades, the Cluster Manager UI, shard rebalancing, and Active-Active synchronization. Internal fixes and improvements. | Redis 8.6.2, 8.4.0, 8.2.1, 8.0.2, 7.4.3, 7.2.7, 6.2.13
8.2.0-25 (July 2026) | Database-scoped management roles. Data path command auditing. | Redis 8.6.2, 8.4.0, 8.2.1, 8.0.2, 7.4.3, 7.2.7, 6.2.13

Version changes

Breaking changes

Redis Software version 8.2.0 introduces the following breaking changes:

• Local import from Redis Software system directories is no longer supported. To improve security, database imports that use the mount_point source can no longer read files from Redis Software system directories, including /opt/redislabs, /var/opt/redislabs, /etc/opt/redislabs, and any of their subdirectories.
  • Import operations that reference files in these directories now fail.
  • Store import files in a non-system location accessible to Redis Software before you start the import.
• smtp_password is now a write-only field in the Cluster API. To improve security, the API no longer returns the SMTP password in responses to GET /v1/cluster, and the Cluster Manager UI no longer reads or displays the existing password.
  • Applications or scripts that previously expected smtp_password to be returned by the Cluster API no longer receive this field.
  • When you update SMTP settings, the existing password cannot be retrieved. To change the SMTP password, provide a new password as part of the update request.
• Custom module upload is disabled by default. To improve security, custom (user-defined) module uploads are now disabled by default. A new cluster setting, allow_modules_upload, controls access to the custom module upload APIs. When this setting is disabled (the default), requests to POST /v2/modules/user-defined and POST /v2/local/modules/user-defined/artifacts return 403 modules_upload_disabled, regardless of user role.
  • To enable custom module uploads, set allow_modules_upload to true with a PUT /v1/cluster request.
  • Applications or automation that call the custom module upload APIs directly receive a 403 modules_upload_disabled response until the setting is enabled.
  • Existing functionality for listing, deleting, and loading modules is unchanged.

Reserved ports

Make sure the following ports are open before upgrading Redis Software.

The following port was added as a reserved port in Redis Software version 8.0.18; however, it is optional instead of reserved in Redis Software version 8.0.20-44:

Port | Process name | Usage
3357 | reconciliation_tree_grpc | Internal communication

Ports reserved as of Redis Software version 7.22.0:

Port | Process name | Usage
3346 | cluster_api_internal | Cluster API internal port
3351 | cluster_watchdog_grpc_api | Cluster watchdog now supports gRPC
3352 | grpc_service_mesh | gRPC communication between nodes
3353 | local_grpc_service_mesh | Local gRPC services
3354 | grpc_gossip_envoy | gRPC gossip protocol communication between nodes
3355 | authentication_service | Authentication service internal port

Ports reserved as of Redis Software version 7.8.2:

Port | Process name | Usage
3347 | cert_exporter | Reports cluster certificate metrics
3348 | process_exporter | Reports process metrics for DMC and Redis processes
3349 | cluster_wd_exporter | Reports cluster watchdog metrics
3350 | db_controller | Internode communication
9091 | node_exporter | Reports host node metrics related to CPU, memory, disk, and more
9125 | statsd_exporter | Reports push metrics related to the DMC and syncer, and some cluster and node metrics

See Ports and port ranges used by Redis Software for a complete list.

Deprecations

API deprecations

• The db_conns_auditing cluster policy and database configuration field is deprecated. Use the audit_settings.audit_mode field instead. Setting db_conns_auditing to true is equivalent to setting audit_mode to connection. See Audit events for the current auditing configuration.
• The gradual_src_mode, gradual_sync_mode, and gradual_sync_max_shards_per_source parameters are deprecated. Use gradual_sync_policy instead. You can set it with rladmin tune db or the REST API.
• The old_password field in POST /v1/users/password and PUT /v1/users/password requests is deprecated and ignored. It was optional and had no effect when adding or resetting a password, so you can remove it from these requests. old_password is still required for DELETE /v1/users/password, which uses it to identify the password to delete.
• The following REST API fields, deprecated since Redis Software version 6.4.2, are removed in this release:
  • use_ipv6 (cluster object) — use use_external_ipv6 instead.
  • redis_cleanup_job_settings (job scheduler object) — use persistence_cleanup_scan_interval instead.

Internal monitoring and v1 Prometheus metrics deprecation

The existing internal monitoring engine is deprecated. We recommend transitioning to the new metrics stream engine for improved performance, enhanced integration capabilities, and modernized metrics streaming.

V1 Prometheus metrics are deprecated but still available. To transition to the new metrics stream engine, either migrate your existing dashboards using this guide or use new preconfigured dashboards.

As part of the transition to the metrics stream engine, some internal cluster manager alerts were deprecated in favor of external monitoring solutions. See the alerts transition plan for guidance.

Supported platforms

The following table provides a snapshot of supported platforms as of this Redis Software release. See the supported platforms reference for more details about operating system compatibility.

✅ Supported – The platform is supported for this version of Redis Software and Redis Stack modules.
⚠️ Deprecation warning – The platform is still supported for this version of Redis Software, but support will be removed in a future release.

(Platform support table omitted for brevity)

Known issues

• RS155734: Endpoint availability metrics do not work as expected due to a calculation error.

Known limitations

Redis Search query failures during rolling upgrades across the 8.4 version boundary

Redis Search queries can fail during a rolling upgrade when a cluster contains shards running Redis versions earlier than 8.4 and shards running Redis version 8.4 or later, due to an internal protocol change introduced in version 8.4. This issue affects only clusters where parallel_shards_upgrade has been changed from its default value of 0. If both conditions apply, expect Redis Search downtime until all nodes are upgraded.

Trim ACKED not supported for Active-Active 8.4 databases

For Active-Active databases running Redis database version 8.4, the ACKED option is not supported for trimming commands.

Rolling upgrade limitation for clusters with custom or deprecated modules

Due to module handling changes introduced in Redis Software version 8.0, upgrading a cluster that contains custom or deprecated modules, such as RedisGraph and RedisGears v2, can become stuck when adding a new node to the cluster during a rolling upgrade.

Module commands limitation during Active-Active database upgrades to Redis 8.0

When upgrading an Active-Active database to Redis version 8.0, you cannot use module commands until all Active-Active database instances have been upgraded. Currently, these commands are not blocked automatically.

Redis 8.0 database cannot be created with flash

You cannot create a Redis 8.0 database with flash storage enabled. Create a Redis 8.0 database with RAM-only storage instead, or use Redis 8.2 for flash-enabled (Redis Flex) databases.

New Cluster Manager UI limitations

The following legacy UI features are not yet available in the new Cluster Manager UI:

• Purge an Active-Active instance. Use crdb-cli crdb purge-instance instead.
• Search and export the log.

SCAN results can be inconsistent during a rolling upgrade in OSS Cluster API mode

During a rolling upgrade with Smart client handoffs (SCH) enabled, when some slot's shards have migrated to a different node but are still reachable from their original node, results of the SCAN command might be inconsistent: it might show some of the keys, it might show keys that are not reachable from that node, or it might show no keys. When the slot migration is done, this issue will fix itself.

Original source

This is the General Availability release of Redis 8.10 in Redis Open Source.

Major changes compared to 8.8

• Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
• New command: HIMPORT - high-throughput compact hash bulk insertion
• TLS peer certificate-based server-to-server authentication
• New commands: LMOVEM, BLMOVEM - move multiple elements between lists
• New command: SUNIONCARD - get the cardinality of the union of multiple sets
• New command: SDIFFCARD - get the cardinality of the difference between sets
• New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
• XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
• New command: FT.ALIASLIST - get all aliases for the index
• Stemmer support for Malay and Tagalog languages
• JSONPath extensions
• New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
• New command: TS.READ - optionally blocking read
• New command: TS.QUERYLABELS - Get a list of labels and label-values
• New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
• Performance improvements

Binary distributions

• Alpine and Debian Docker images - https://hub.docker.com/_/redis
• Install using snap - see https://github.com/redis/redis-snap
• Install using brew - see https://github.com/redis/homebrew-redis
• Install using RPM - see https://github.com/redis/redis-rpm
• Install using Debian APT - see https://github.com/redis/redis-debian

Operating systems we test Redis 8.10 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

Bug fixes (compared to 8.10-RC2)

• #15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
• #15453 Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
• #15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed
• #15518 notify modules when node's own ip/port changes
• #15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
• RediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)
• RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)
• RediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)
• RediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)
• RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)
• RediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)

Original source

SECURITY: There are security fixes in the release.

Security fixes

A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

RedisBloom/RedisBloom#1020 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

Original source

SECURITY

There are security fixes in the release.

Security fixes

A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

RedisBloom/RedisBloom#1019 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

Original source

SECURITY

There are security fixes in the release.

Security fixes

A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

RedisBloom/RedisBloom#1021 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

Original source