Redis 8.6.6
Security release addressing multiple critical vulnerabilities including heap buffer overflows, use-after-free conditions, ACL authentication bypasses, and TLS certificate validation issues that could lead to memory corruption or unauthorized access.
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
- (CVE-2026-62356) Miscalculated buffer size in
CMSketchRDB loading may lead to heap OOB write - Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in
SORT,GEORADIUS/GEORADIUSBYMEMBERandXREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses - A malicious RDB payload with an out-of-range
SLOT_INFOslot id causes memory corruption during RDB loading, which may lead to Remote Code Execution - Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when
VREMmutates the HNSW graph while backgroundVSIMthreads are still running - Vector Sets: a negative
hnsw_search()return was treated as a huge unsigned count, reading past the end of the result arrays - TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key
Source: original entry ↗
More from Redis
Follow Redis to get its new changes in your feed and email digest.
Improve test timeout diagnostics with crash reports and stack traces
When a test times out, the system now collects crash reports from Redis servers and stack traces from clients before terminating, providing better diagnostics for hung tests instead of silently killing them.
Security fixes in Redis 8.10.2
This release addresses critical security vulnerabilities including ACL permission bypasses in transactions, unauthenticated cluster bus access, and server crashes in TimeSeries, RedisSearch, and Vector Sets. The new cluster-bus-port-protected-mode option allows nodes to require TLS authentication for cluster bus communication.
Redis 8.8.3 Security and Stability Release
This release includes critical security fixes for transaction ACL bypasses, cluster bus authentication warnings, and crash prevention in TimeSeries and Vector Sets. A new cluster-bus-port-protected-mode option allows nodes to enforce authentication on the cluster bus port.