最新のセキュリティ情報
9月28日(月)
8.12-m02-int: Explain a test [TIMEOUT] instead of killing it silently (#15879)
A hung test run tells us almost nothing today. When no client has made progress for --timeout seconds, test_server_cron prints the clients' last reported state, SIGKILLs every server via force_kill_all_servers and exits; --dump-logs only fires for a failed or excepted test, never for a timeout. So a 20-minute hang costs a whole CI run and produces a few lines. Collect the evidence before tearing the run down: Crash-report the surviving servers. SIGSEGV makes redis log a stack trace of every one of its threads plus INFO, the client list and the config (printCrashReport) and then die. The handl…
9月18日(金)
8.10.2
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.8.3
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.6.7
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
9月17日(木)
8.4.7
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: s…
8.2.10
Update urgency: SECURITY : There are security fixes in the release. Security fixes #15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no ) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus TimeSeries: Prevented Redis from crashing when adding samp…
9月15日(火)
8.12-m01-int: Add aof_cmd_duration estimate for AOF reload RTO visibility
Expose a best-effort AOF replay-time estimate in INFO persistence so operators can gauge reload RTO. Count time only for writes that enter the AOF, credit leftover call() time to synthetic rewrites, and skip the bookkeeping when AOF is off.
8月20日(木)
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security compares UserVerificationRequirement using identity ( == ) when determining whether user verification is required during a WebAuthn ceremony. When HTTP sessions are serialized and deserialized, as occurs with distributed session stores (e.g., Spring Session with Redis or JDBC), the deserialized UserVerificationRequirement instance is not the same object reference as the static constant REQUIRED . The identity comparison evaluates to…
8月18日(火)
8.10.1
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access Vector Sets…
8.8.2
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…
8.6.6
Update urgency: SECURITY : There are security fixes in the release. Security fixes (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write Out-of-bounds access in TopK heap cleanup path (MOD-15410) Use-after-free in the TLS pending-data list when a command closes another pending connection #15478 ACL key permission bypass in SORT , GEORADIUS / GEORADIUSBYMEMBER and XREAD / XREADGROUP : the keys validated by ACL could differ from the keys the command actually accesses A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption d…
7月2日(木)
Laravel June product updates
You can now run Symfony apps on Laravel Cloud, managed Valkey caches and object storage are available in Forge, Bus::bulk() for efficient batch dispatch, and MCP client and server tooling across Laravel's AI stack. Here's everything that shipped in June.
5月1日(金)
What's new in Swift: April 2026 Edition
Welcome to “What’s new in Swift,” a curated digest of releases, videos, and discussions in the Swift project and community. The 1.0 release of valkey-swift was recently announced on the Valkey blog . We’ve invited one of the authors to be this month’s guest contributor: Hi, I’m Adam Fowler, an open source developer working in the Swift on server ecosystem. I am excited to announce the 1.0 release of valkey-swift - a production-grade Swift client for Valkey . Valkey is a high-performance datastore commonly used as a caching layer or message broker in server applications. It is an open source f…
2月3日(火)
Laravel January Product Releases
January brings Private Cloud, Valkey caching, expanded Cloud API, plus Forge backup options and Nightwatch real-time exception detection.
12月13日(水)
Deno KV vs. Cloudflare Workers KV, Upstash Redis, AWS DynamoDB, and Google Firestore
We compare Deno KV to other serverless data stores on performance, price, developer experience, and more.
5月4日(火)
Vapor: Redis 6.x Clusters Are Now Available
Starting today, in addition to Redis 5.x Clusters, you may now also create and manage Redis 6.x Clusters. Redis 6.x is the latest version of open-source Redis software. This new version brings improved security and boosts the performance of your cache.
9月7日(月)
Forge: TLS v1.3, Redis Passwords and more!
Over the last few weeks, we've been working on many new features and enhancements in Forge. I often [tweet](https://twitter.com/jbrooksuk) about these changes since they don’t warrant a full-blown blo...