Redis — Database product updates and releases, tracked on megachangelog.
When a test times out, the system now collects crash reports from Redis servers and stack traces from clients before terminating, providing better diagnostics for hung tests instead of silently killing them.
This release addresses critical security vulnerabilities including ACL permission bypasses in transactions, unauthenticated cluster bus access, and server crashes in TimeSeries, RedisSearch, and Vector Sets. The new cluster-bus-port-protected-mode option allows nodes to require TLS authentication for cluster bus communication.
This release includes critical security fixes for transaction ACL bypasses, cluster bus authentication warnings, and crash prevention in TimeSeries and Vector Sets. A new cluster-bus-port-protected-mode option allows nodes to enforce authentication on the cluster bus port.
This release addresses multiple security vulnerabilities including ACL permission bypass in transactions, unauthenticated cluster bus access, and crash issues in TimeSeries and Vector Sets modules. Security fixes cover transaction ACL enforcement, cluster bus authentication, and handling of malformed data structures.
This security release fixes multiple vulnerabilities including ACL permission bypass in transactions, unauthenticated cluster bus access, and crashes in TimeSeries and Vector Sets modules. Updates are strongly recommended for all users.
Security fixes for unauthenticated cluster bus protocol vulnerability, TimeSeries crash when processing compressed samples from malformed RDB, and Vector Sets crash from deeply nested JSON queries. The cluster-bus-port-protected-mode option is now available to enforce authentication requirements on the cluster bus port.
Expose a best-effort AOF replay-time estimate in INFO persistence output to help operators gauge reload recovery time. The estimate counts time only for writes entering the AOF and skips bookkeeping when AOF is disabled.
This security release fixes multiple critical vulnerabilities including out-of-bounds write in CMSketch RDB loading, TLS certificate authentication bypass, use-after-free issues in Vector Sets, and heap overflow risks. These fixes prevent remote code execution, memory corruption, and privilege escalation attacks.
This release fixes multiple critical security vulnerabilities including heap buffer overflows, use-after-free issues, ACL bypass flaws, and TLS authentication bypasses across CMSketch, TopK, vector sets, and command handling. Applications should update immediately to patch remote code execution risks and unauthorized access issues.
Security release addressing multiple critical vulnerabilities including heap buffer overflows, use-after-free conditions, ACL authentication bypasses, and TLS certificate validation issues that could lead to memory corruption or unauthorized access.
This release addresses multiple critical security vulnerabilities including buffer overflows, use-after-free bugs, ACL permission bypasses, and out-of-bounds access issues in RDB loading and Vector Sets. These fixes prevent potential remote code execution and memory corruption attacks.
Redis 8.2.9 addresses multiple critical security vulnerabilities including buffer overflow in CMSketch RDB loading, out-of-bounds access issues, use-after-free flaws in TLS and blocking clients, ACL key permission bypass in several commands, and Vector Sets memory safety issues. These fixes prevent potential heap corruption, remote code execution, and unauthorized data access.
This release includes multiple critical security fixes addressing use-after-free vulnerabilities in TLS and blocked-client handling, ACL key permission bypass issues in several commands, out-of-bounds memory access during ACL permission checks, and RDB loading vulnerabilities that could lead to remote code execution.
This release addresses critical security vulnerabilities including use-after-free issues in TLS and blocked-client handling, ACL key permission bypasses in SORT and XREAD commands, and out-of-bounds memory access during ACL permission checks. Users should update immediately.
A use-after-free vulnerability in the TLS pending-data list has been fixed that could occur when a command closes another pending connection. This is a critical security update.
Redis 8.10 introduces major new features including compact hash encoding for memory optimization, new list and set cardinality commands, TLS peer certificate authentication, and performance improvements across multiple modules. This release also includes bug fixes and expanded platform support.
A security vulnerability in RedisBloom and TDigest where crafted RESTORE payloads could trigger out-of-bounds writes has been fixed, preventing potential remote code execution.
This release contains critical security fixes addressing use-after-free vulnerabilities in stream RESTORE payloads and RedisBloom that could lead to remote code execution, as well as a bug fix to prevent silent Cuckoo Filter data loss on failover.
This release addresses critical security vulnerabilities including a use-after-free issue in stream consumer group restoration that could lead to remote code execution, and out-of-bounds writes in RedisBloom and TDigest. It also fixes Cuckoo Filter data loss on failover by properly replicating CF.LOADCHUNK data chunks.
This release addresses critical security vulnerabilities including a use-after-free issue in stream consumer group restoration that could lead to remote code execution, and out-of-bounds write vulnerabilities in RedisBloom and TDigest. Also fixes a bug preventing Cuckoo Filter data replication on failover.
Fixed a critical security vulnerability where a crafted stream RESTORE payload could cause two consumers to share the same NACK, leading to a use-after-free condition that may result in Remote Code Execution.
A crafted stream RESTORE payload could cause two consumers to share the same NACK entry, leading to a use-after-free condition that may result in Remote Code Execution. This security vulnerability has been patched.
Fixed a critical security vulnerability where a crafted stream RESTORE payload could cause two consumers to share the same NACK, leading to use-after-free and potential remote code execution.
Second release candidate for Redis 8.10 with bug fixes including a security issue where users could manipulate data through injected sequences in error replies, and a build failure caused by a typo in release.h.
First Release Candidate of Redis 8.10 introducing new features including compact hash encoding, new list and set commands, backup functionality, and extensions to RediSearch, RedisJSON, and RedisTimeSeries. Pre-release is feature-complete but not suitable for production use.
Bumps RedisTimeSeries from v8.9.82 to v8.9.90, adding cluster topology auto-refresh, the new TS.QUERYLABELS command, EXCLUDEEMPTY support in TS.MRANGE/TS.MREVRANGE, and improved TS.INCRBY replication behavior for lower timestamps.
Optimized RESTORE REPLACE command to use a single dictionary lookup instead of three when adding new keys, reducing overhead during dictionary rehashing operations.
Updates the bundled RediSearch module from v8.9.80 to v8.9.81, pulling in the latest tagged upstream release for the 8.10 MS2 branch.
RediSearch module bundled with Redis has been updated from v8.8.0 to v8.9.80. This is a low-risk version bump that only modifies the MODULE_VERSION in the build configuration.
This release addresses critical bugs affecting stability, data consistency, and security, including startup failures on AArch64, memory accounting issues, cluster crashes, and potential use-after-free vulnerabilities. Immediate update is recommended for users running affected configurations.
This release addresses multiple critical bugs affecting startup, memory accounting, ACL loading, replication, and RediSearch indexes. Updates are recommended for users experiencing server hangs, crashes during synchronization, or ACL/stream operation issues.
Critical bug fixes addressing startup failures on AArch64, SCAN filter order, stream operations, cluster heap-buffer overflows, and TCP stability issues. High update urgency due to critical bugs affecting some users.
Redis 8.8.0 introduces a new Array data structure, subkey notifications for hash fields, the INCREX rate limiter command, XNACK for stream message release, and enhancements to sorted set operations, JSON, and time-series commands. This GA release also includes performance improvements and bug fixes.
First release candidate of Redis 8.8 with new data structures, performance improvements, and security fixes. Includes multiple CVE patches and bug fixes across Redis, RediSearch, RedisJSON, and RedisTimeSeries modules.
This release addresses critical security vulnerabilities including use-after-free and invalid memory access issues that could lead to remote code execution, plus numerous bug fixes affecting SUBSCRIBE commands, CONFIG SET, Lua scripts, and RediSearch operations.
Redis 8.4.3 addresses five critical CVEs including use-after-free and invalid memory access vulnerabilities that could lead to remote code execution, plus numerous bug fixes for crashes and inconsistencies in SUBSCRIBE, CONFIG SET, SCRIPT DEBUG, and RediSearch operations.
Redis 8.2.6 addresses critical security vulnerabilities including use-after-free flaws in unblock client flow, RESTORE commands, and Lua scripts that could lead to remote code execution. The release also fixes numerous stability issues across core Redis and modules including SUBSCRIBE crashes on OOM, RediSearch index consistency problems, and memory management issues.
Critical security release fixing three remote code execution vulnerabilities in the unblock client flow, RESTORE command, and Lua execution, plus bug fixes for subscribe crash on OOM and config validation issues.
Security release addressing three critical vulnerabilities that could lead to remote code execution, plus bug fixes for crashes in subscribe operations, config validation, and script debugging.
36 more changes from Redis. Sign up to read the whole changelog.
Sign up freeGitHub or email — no card needed.