最新のセキュリティ情報
9月18日(金)
8.10.2
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.8.3
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.6.7
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
9月17日(木)
8.4.7
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.2.10
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus TimeSeries: Prevented Redis from crashing when adding samp…
8月20日(木)
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security compares UserVerificationRequirement using identity ( == ) when determining whether user verification is required during a WebAuthn ceremony. When HTTP sessions are serialized and deserialized, as occurs with distributed session stores (e.g., Spring Session with Redis or JDBC), the deserialized UserVerificationRequirement instance is not the same object reference as the static constant REQUIRED . The identity comparison evaluates to…
8月18日(火)
8.10.1
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access Vector Sets…
8.8.2
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…
8.6.6
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…
10月11日(土)
Bun 1.3
Bun 1.3 introduces zero-config frontend development, unified SQL API, built-in Redis client, security enhancements, package catalogs, async stack traces, VS Code test integration, and Node.js compatibility improvements.
5月4日(火)
Vapor: Redis 6.x Clusters Are Now Available
Starting today, in addition to Redis 5.x Clusters, you may now also create and manage Redis 6.x Clusters. Redis 6.x is the latest version of open-source Redis software. This new version brings improved security and boosts the performance of your cache.