CVE-2026-62356

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write

Out-of-bounds access in TopK heap cleanup path (MOD-15410)

Use-after-free in the TLS pending-data list when a command closes another pending connection

A malicious RDB payload with an out-of-range SLOT INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution

Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access

Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running

Vector Sets: a negative hnsw search() return was treated as a huge unsigned count, reading past the end of the result arrays

TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user

#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Restrict the "modules" flavour to x86 64 and aarch64 -- RedisBloom and RedisTimeSeries abort on anything else with "only supports 64-bit architectures (x64, arm64v8)", redisjson's vendored redis-module is 64-bit only, and modules/common.mk maps no other architecture at all

Update to 8.10.0

Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema

New command: HIMPORT - high-throughput compact hash bulk insertion

TLS peer certificate-based server-to-server authentication

New commands: LMOVEM, BLMOVEM - move multiple elements between lists

New command: SUNIONCARD - get the cardinality of the union of multiple sets

New command: SDIFFCARD - get the cardinality of the difference between sets

New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)

XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size

New command: FT.ALIASLIST - get all aliases for the index

Stemmer support for Malay and Tagalog languages

JSONPath extensions

New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp

New command: TS.READ - optionally blocking read

New command: TS.QUERYLABELS - Get a list of labels and label-values

New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples

Performance improvements

Update to 8.8.1 Security fixes

RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Update to 8.8.0

New data structure: Array (@antirez)

Subkey notification for hash fields - field-level notifications

INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)

XNACK: a new streams command - allow consumers to explicitly release pending messages

ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator

JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays

TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command

FT.HYBRID KNN clause: new argument to request fewer candidates per shard

FT.PROFILE HYBRID: profiling support for FT.HYBRID

Performance improvements

Updated to 8.6.3 (boo#1264164 boo#1264165 boo#1264166 boo#1264167 boo#1264168)

Security fixes

(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.

(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution

(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution

(CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)

(CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)

Bug fixes

SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)

CONFIG SET: some settings allow invalid characters (RED-167787)

SCRIPT DEBUG: potential crash on scripts (RED-175507)

VADD: crash or buffer overflow on large REDUCE value (RED-170921)

VSET: crash on huge allocations (MOD-12678)

Potential crash on disconnections and TLS failures (Time Series) (MOD-14850)

RediSearch/RediSearch#8745 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)

RediSearch/RediSearch#8848 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)

RediSearch/RediSearch#8205, RediSearch/RediSearch#8259 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-12370, MOD-13884)

RediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty reply (MOD-14778)

RediSearch/RediSearch#8129, RediSearch/RediSearch#8140 FT.PROFILE reports an incorrect shard total profile time (MOD-13735, MOD-13181)

RediSearch/RediSearch#9047 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)

RediSearch/RediSearch#8791 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)

RediSearch/RediSearch#8382 Crash when indexing negative zero (-0.0) (MOD-13904)

RediSearch/RediSearch#8590 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)

RediSearch/RediSearch#8660 FILTER behavior depends on property order in the expression (MOD-14065)

RediSearch/RediSearch#8593 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)

RediSearch/RediSearch#8591 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)

RediSearch/RediSearch#8589 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14328)

RediSearch/RediSearch#9012 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)

RediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)

RediSearch/RediSearch#8462 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)

RediSearch/RediSearch#9066 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)

RediSearch/RediSearch#8109, RediSearch/RediSearch#8149 Configuration registration omits module parameters, causing them to be unexposed or misapplied (RED-171841)

RediSearch/RediSearch#9163 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)

RediSearch/RediSearch#8395 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828)

RediSearch/RediSearch#8451 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14079)

RediSearch/RediSearch#9078 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)

RediSearch/RediSearch#8051, RediSearch/RediSearch#8114 Crash diagnostics now include the IndexSpec of the index the failing thread was working on (MOD-7574)

Metrics

RediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)

Updated to 8.6.2 (boo#1260399)

#14695 Keys memory size histograms

#14615 Streams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments

#14624 New eviction policies - least recently modified: volatile-lrm and allkeys-lrm

#14680 Hot keys detection and reporting; new command: HOTKEYS

#14610 TLS certificate-based automatic client authentication

RedisTimeSeries/RedisTimeSeries#1853 Time series: support NaN values; new aggregators: COUNTNAN and COUNTALL Security and privacy fixes

#14645 Hide Personally Identifiable Information from ACL log

#14659 ACL: Key-pattern bypass in MSETEX

RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log

RedisBloom/RedisBloom#950 Out-of-bounds read when loading an invalid RDB file (MOD-12802) Bugfixes

#14545 ACL: AOF loading fails if ACL rules are changed and don't allow some commands in MULTI-EXEC

#14637 Atomic slot migration: wrong adjacent slot range behavior

#14567 Atomic slot migration: support delay trimming slots after finishing migrating slots

#14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies

#14552 Streams: Incorrect behavior when using XDELEX...ACKEDafterXGROUP DESTROY`

#14537 SCAN: restore original filter order (revert change introduced in 8.2)

#14581 Rare server hang at shutdown

#14597 Panic when cluster node is uninitialized

#14583 FLUSHALL ASYNC on a writable replica may block the main thread for an extended period

#14504 Cluster: fix race condition in broadcast configuration

#14416 Fixed argument position handling in Redis APIs

RedisTimeSeries/RedisTimeSeries#1784, RedisTimeSeries/RedisTimeSeries#1839, RedisBloom/RedisBloom#952, RedisJSON/RedisJSON#1477 Atomic slot migration support

RedisBloom/RedisBloom#946 MEMORY USAGE: fix reported value (MOD-12799)

RedisJSON/RedisJSON#1473 Adding escapes to already-escaped characters (MOD-8137)

RedisJSON/RedisJSON#1475 JSON.CLEAR does not error if more than one path is specified (MOD-13109) Performance and resource utilization improvements

#14608 Reply copy-avoidance path to reduce memory copies for bulk string replies

#14595 Hash: unify field name and value into a single struct

#14701 Sorted set: unify score and value into a single struct

#14662 Optimize listpack iterator on hash fields

#14699 Optimize set commands with expiration

#14700 Optimize prefetching

#14715 Optimize prefetch sizing logic

#14636 Optimize ZRANK

#14676 Utilize hardware clock by default on ARM AArch64

#14575 Disable RDB compression when diskless replication is used

#14714 Optimize user ACL permission verification

#14692 Optimize peak memory metric collection

#14739 Avoid allocating and releasing list node in reply copy avoidance

#14713 Reduce per command syscalls by reusing cached time when hardware monotonic clock is available

#14726 Optimize XREADGROUP CLAIM

#13962 Vector set: replace manual popcount with builtin popcountll for binary vector distance (Intel, AMD, ARM)

#14474 Vector set: vectorized the quantized 8-bit vector distance calculation (Intel, AMD)

#14492 Vector set: vectorize binary quantization path for vectorsets distance calculation (Intel, AMD) Configuration parameters

#14719 cluster-slot-stats-enabled - per-slot resource consumptions statistics to collect

#14695 key-memory-histograms collect memory consumption histograms per data type Metrics

#14695 db0 distrib lists sizes, db0 distrib sets sizes, db0 distrib hashes sizes, db0 distrib zsets sizes

#14610 acl access denied tls cert - failed TLS certificate–based authentication attempts Modules API

#14445

RM CreateKeyMetaClass - define a new key-metadata class

RM ReleaseKeyMetaClass - release a key-metadata class

RM SetKeyMeta - attach or update a metadata value for a key under a specific metadata-key class

RM GetKeyMeta - get a metadata value for a key under a specific metadata-key class Configuration parameters

#14624 maxmemory-policy: new eviction policies: volatile-lrm, allkeys-lrm

#14615 stream-idmp-duration, stream-idmp-maxsize - defaults for streams idempotent production

#14610 tls-auth-clients-user TLS certificate-based automatic client authentication

#14596 flushdb option for repl-diskless-load: always flush the entire dataset before diskless load Known bugs and limitations

Streams: avoid using XADD with the new IDMP or IDMPAUTO options when using appendonly yes with aof-use-rdb-preamble no (non default). This limitation will be removed in the next patch.

Redis Query Engine: In case of load rebalancing operations (such as Atomic Slot Migration) taking place during the lifetime of a cursor, there is a chance that some results may be missing.

Updated to 8.4.1