Redis Open Source Updates & Release Notes

Note

Low Risk

Changes are limited to the Tcl test harness timeout path; no production server or runtime behavior is affected.

Overview

When the suite hits --timeout (no client progress), it no longer tears down immediately after printing each client’s last task. The test server collects diagnostics first, then kills clients and servers as before.

Server evidence: Still-running Redis instances from ::active_servers get SIGCONT (if stopped) and SIGSEGV so they write a full crash report even when the event loop is wedged. Logs are located under tests/tmp by pid, then dump_crash_report prints the tail around REDIS BUG REPORT START (or the last 256KB if there is no report). is_running treats zombies as dead so waits don’t hang on unreaped children.

Client evidence: Clients send their OS pid on ready and optionally advertise sigusr1-trace when Tclx is available. After server dumps, the server waits briefly for natural exception/err unwinds, then sends SIGUSR1 to remaining clients so Tclx turns it into a stack trace. ::in_timeout_report suppresses re-entrant timeout cron, avoids fatal handling of those packets, and fixes read_from_test_client when a client disconnects mid-report (invalid length no longer spins or crashes the handler).

Order: Server crash collection runs before client stack traces so unblocking a client doesn’t tear down servers before their reports are captured.

Reviewed by Cursor Bugbot for commit 5927e7e. Bugbot is set up for automated code reviews on this repo. Configure here.

Co-authored-by: Claude Opus 5.5 (1M context) [email protected]

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
• #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus
• TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
• RedisSearch: KNN queries on indexes with very long vector field names could cause the server to crash
• Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
• #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus
• TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
• Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
• #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus
• TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
• Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
• #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus
• TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
• Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus

TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload

Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write

Out-of-bounds access in TopK heap cleanup path (MOD-15410)

Use-after-free in the TLS pending-data list when a command closes another pending connection

#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses

A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution

Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access

Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running

Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays

TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user

#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write

Out-of-bounds access in TopK heap cleanup path (MOD-15410)

Use-after-free in the TLS pending-data list when a command closes another pending connection

#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses

#14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity

A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution

Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access

Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running

Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays

#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key