Redis 8.2.8 Security Release
This release addresses critical security vulnerabilities including a use-after-free issue in stream consumer group restoration that could lead to remote code execution, and out-of-bounds write vulnerabilities in RedisBloom and TDigest. Also fixes a bug preventing Cuckoo Filter data replication on failover.
SECURITY: There are security fixes in the release.
Security fixes
- Use-after-free when loading a stream consumer group via
RESTOREmay lead to Remote Code Execution - RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
Bug fixes
- RedisBloom/RedisBloom#1019 Replicate
CF.LOADCHUNKdata chunks to prevent silent Cuckoo Filter data loss on failover
Source: original entry ↗
More from Redis
Follow Redis to get its new changes in your feed and email digest.
Improve test timeout diagnostics with crash reports and stack traces
When a test times out, the system now collects crash reports from Redis servers and stack traces from clients before terminating, providing better diagnostics for hung tests instead of silently killing them.
Security fixes in Redis 8.10.2
This release addresses critical security vulnerabilities including ACL permission bypasses in transactions, unauthenticated cluster bus access, and server crashes in TimeSeries, RedisSearch, and Vector Sets. The new cluster-bus-port-protected-mode option allows nodes to require TLS authentication for cluster bus communication.
Redis 8.8.3 Security and Stability Release
This release includes critical security fixes for transaction ACL bypasses, cluster bus authentication warnings, and crash prevention in TimeSeries and Vector Sets. A new cluster-bus-port-protected-mode option allows nodes to enforce authentication on the cluster bus port.