Redis Open Source Updates & Release Notes

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write

Out-of-bounds access in TopK heap cleanup path (MOD-15410)

Use-after-free in the TLS pending-data list when a command closes another pending connection

#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses

A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution

Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access

Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running

Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays

TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user

#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write

Out-of-bounds access in TopK heap cleanup path (MOD-15410)

Use-after-free in the TLS pending-data list when a command closes another pending connection

#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses

#14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity

A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution

Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access

Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running

Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays

#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

This is the General Availability release of Redis 8.10 in Redis Open Source.

Major changes compared to 8.8

• Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
• New command: HIMPORT - high-throughput compact hash bulk insertion
• TLS peer certificate-based server-to-server authentication
• New commands: LMOVEM, BLMOVEM - move multiple elements between lists
• New command: SUNIONCARD - get the cardinality of the union of multiple sets
• New command: SDIFFCARD - get the cardinality of the difference between sets
• New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
• XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
• New command: FT.ALIASLIST - get all aliases for the index
• Stemmer support for Malay and Tagalog languages
• JSONPath extensions
• New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
• New command: TS.READ - optionally blocking read
• New command: TS.QUERYLABELS - Get a list of labels and label-values
• New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
• Performance improvements

Binary distributions

• Alpine and Debian Docker images - https://hub.docker.com/_/redis
• Install using snap - see https://github.com/redis/redis-snap
• Install using brew - see https://github.com/redis/homebrew-redis
• Install using RPM - see https://github.com/redis/redis-rpm
• Install using Debian APT - see https://github.com/redis/redis-debian

Operating systems we test Redis 8.10 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

Bug fixes (compared to 8.10-RC2)

• #15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
• #15453 Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
• #15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed
• #15518 notify modules when node's own ip/port changes
• #15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
• RediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)
• RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)
• RediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)
• RediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)
• RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)
• RediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)

SECURITY: There are security fixes in the release.

Security fixes

A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

RedisBloom/RedisBloom#1020 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY

There are security fixes in the release.

Security fixes

A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

RedisBloom/RedisBloom#1019 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY

There are security fixes in the release.

Security fixes

A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

RedisBloom/RedisBloom#1021 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover