From Redis Releases
Fri, September 18
8.10.2
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.8.3
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.6.7
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
Thu, September 17
8.4.7
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.2.10
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus TimeSeries: Prevented Redis from crashing when adding samp…
Tue, August 18
8.10.1
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access Vector Sets…
8.8.2
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…
8.6.6
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…