summary: Pub/sub ACLs & default permissions. Validate client certificates by subject attributes. Ubuntu 20.04 support.

summary: Internal fixes and improvements.

title: Redis Enterprise Software release notes 6.4.2-131 (September 2025)

summary: Internal fixes and improvements.

title: Redis Enterprise Software release notes 6.4.2-127 (June 2025)

summary: Internal fixes and improvements.

title: Redis Enterprise Software release notes 6.4.2-121 (March 2025)

summary: RediSearch v2.6.23. RedisBloom v2.4.12. RedisTimeSeries v1.8.15.

title: Redis Enterprise Software release notes 6.4.2-115 (Oct 2024)

summary: RedisGraph v2.10.15. RedisBloom v2.4.8. Bug fixes.

title: Redis Enterprise Software release notes 6.4.2-110 (May 2024)

summary: RHEL 8.8 support. RediSearch v2.6.12. RedisGraph v2.10.12. RedisTimeSeries v1.8.11 Log when CCS schema changes. Bug fixes.

title: Redis Enterprise Software release notes 6.4.2-103 (October 2023)

summary: Look-ahead mechanism for planner attempts. Package OS compatibility validation.

title: Redis Enterprise Software release notes 6.4.2-94 (July 2023)

summary: Email alerts for database backup failures and replica high availability shard relocation failures.

title: Redis Enterprise Software release notes 6.4.2-81 (June 2023)

summary: Amazon Linux 2 support. Configure envoy ports using rladmin. Added option to avoid specific nodes when using the optimized shards placement API. Added failure_detection_sensitivity to replace watchdog_profile.

title: Redis Enterprise Software release notes 6.4.2-69 (May 2023)

summary: Amazon Linux 2 support. Fixed known limitations for custom installation on RHEL 7 and RHEL 8, running rl_rdbconvert manually, and resharding rack-aware databases with no replication.

title: Redis Enterprise Software release notes 6.4.2-61 (April 2023)

summary: Ubuntu 20.04 support. Safe node removal. Allow gossip_envoy port configuration.

title: Redis Enterprise Software release notes 6.4.2-43 (March 2023)

title: Redis Enterprise Software release notes 6.4.2-30 (February 2023)

title: Overview

text:
[Redis Enterprise Software version 6.4.2](https://redis.io/downloads/#software) is now available!

This version offers:

- Extended validation of client certificates via mTLS (mutual TLS) full subject support

- Support for default restrictive permissions when using publish/subscribe commands and access control lists (ACLs)

- Enhanced TLS performance when Redis returns large arrays in responses

- Compatibility with [open source Redis](https://github.com/redis/redis) 6.2.7 and 6.2.10.

- Additional enhancements and bug fixes

title: Detailed release notes

text: For more detailed release notes, select a build version from the following table:

title: Deprecations

title: Ubuntu 16.04

text: Ubuntu 16 support is considered deprecated and will be removed in a future release. Ubuntu 16.04 LTS (Xenial) has reached the end of its free initial five-year security maintenance period as of April 30, 2021.

title: Active-Active database persistence

text:
The RDB snapshot option for [Active-Active database persistence]() is deprecated and will be removed in a future release.

Please plan to reconfigure any Active-Active databases to use append-only file (AOF) persistence with the following command:

[code example]

title: TLS 1.0 and TLS 1.1

text:
TLS 1.0 and TLS 1.1 connections are considered deprecated in favor of TLS 1.2 or later.
Please verify that all clients, apps, and connections support TLS 1.2. Support for the earlier protocols will be removed in a future release.
Certain operating systems, such as RHEL 8, have already removed support for the earlier protocols. Redis Enterprise Software cannot support connection protocols that are not supported by the underlying operating system.

title: 3DES encryption cipher

text:
The 3DES encryption cipher is considered deprecated in favor of stronger ciphers like AES.
Please verify that all clients, apps, and connections support the AES cipher. Support for 3DES will be removed in a future release.
Certain operating systems, such as RHEL 8, have already removed support for 3DES. Redis Enterprise Software cannot support cipher suites that are not supported by the underlying operating system.

title: Known limitations

title: Feature limitations

text:
- RS97971 - [Resharding fails for rack-aware databases with no replication](#resharding-fails-for-rack-aware-databases-with-no-replication) (fixed and resolved as part of [v6.4.2-61]()).

- RS101204 - High memory consumption caused by the `persistence_mgr` service when AOF persistence is configured for every second (fixed and resolved as part of [v6.4.2-81]()).

- RS40641 - API requests are redirected to an internal IP in case the request arrives from a node which is not the master. To avoid this issue, use [`rladmin cluster config`]() to configure `handle_redirects` or `handle_metrics_redirects`.

- RS51144, RS102128 - Active-Active: To start successfully, the syncer (`crdt-syncer`) must connect to all sources. In multi-cluster configurations (more than 2 A-A clusters participating), in some cases, if one or more of the clusters is not available, A-A replication will be down.

- RS123142 - In an Active-Active setup with at least three participating clusters, removing and re-adding a cluster after removing older clusters without re-adding them can cause missing keys and potentially lead to data loss or data inconsistency.

    This issue will be fixed in a future maintenance release. To prevent this issue, avoid adding clusters until you upgrade to the upcoming maintenance release when available.

#### Resharding fails for rack-aware databases with no replication

When a database is configured as [rack-aware]() and replication is turned off, the resharding operation fails.

RS97971 - This limitation was fixed and resolved as part of [v6.4.2-61]().

Workaround:

Before resharding your database, turn off rack awareness:

[code example]

After the resharding process is complete, you can re-enable rack awareness:

[code example]

title: Installation limitations

title: Upgrade limitations

text:
Before you upgrade a cluster that hosts Active-Active databases with modules to v6.4.2-30, perform the following steps:

1. Use `crdb-cli` to verify that the modules (`modules`) and their versions (in `module_list`) are as they appear in the database configuration and in the default database configuration:

    [code example]

1. From the admin console's **redis modules** tab, validate that these modules with their specific versions are loaded to the cluster.

1. If one or more of the modules/versions are missing or if you need help, [contact Redis support](https://redis.com/company/support/) before taking additional steps.

This limitation has been fixed and resolved as of [v6.4.2-43]().

title: Operating system limitations

text:
#### RHEL 7 and RHEL 8

RS95344 - CRDB database will not start on Redis Enterprise v6.4.2 with a custom installation path.

For a workaround, use the following commands to add the relevant CRDB files to the Redis library:

[code example]

This limitation has been fixed and resolved as of [v6.4.2-61]().

#### RHEL 8

Due to module binary differences between RHEL 7 and RHEL 8, you cannot upgrade RHEL 7 clusters to RHEL 8 when they host databases using modules. Instead, you need to create a new cluster on RHEL 8 and then migrate existing data from your RHEL 7 cluster. This does not apply to clusters that do not use modules.

#### Ubuntu 20.04

By default, you cannot use the SHA1 hash algorithm ([OpenSSL’s default security level is set to 2](https://manpages.ubuntu.com/manpages/focal/man3/SSL_CTX_set_security_level.3ssl.html#notes)). The operating system will reject SHA1 certificates even if the `mtls_allow_weak_hashing` option is enabled. You need to replace SHA1 certificates with newer certificates that use SHA-256. Note that the certificates provided with Redis Enterprise Software use SHA-256.

#### Modules not supported for Amazon Linux 2 release candidate

A database with modules cannot reside on an Amazon Linux 2 (release candidate) node. Support was added as part of [v6.4.2-69]().

code:
crdb-cli crdb update --crdb-guid <CRDB_GUID> \
    --default-db-config '{"data_persistence": "aof", "aof_policy":"appendfsync-every-sec"}'

code: curl -k -u "<user>:<password>" -H "Content-type: application/json" -d '{"rack_aware": false}' -X PUT "https://localhost:9443/v1/bdbs/<bdb_uid>"

section_id: feature-limitations

code: curl -k -u "<user>:<password>" -H "Content-type: application/json" -d '{"rack_aware": true}' -X PUT "https://localhost:9443/v1/bdbs/<bdb_uid>"

code:
$ yum install -y chrpath
$ find $installdir -name "crdt.so" | xargs -n1 -I {} /bin/bash -c 'chrpath -r ${libdir} {}'

section_id: operating-system-limitations


page_type: content

title: Overview

role: overview

text: This is a maintenance release for [Redis Enterprise Software version 6.4.2](https://redis.io/downloads/#software).

title: Highlights

role: content

text:
This version offers:

- RHEL 8.8 support

- RediSearch v2.6.12, RedisGraph v2.10.12, and RedisTimeSeries v1.8.11

- Log when CCS schema changes

- Bug fixes

title: New in this release

title: Enhancements

text:
- RHEL 8.8 support

- Log when CCS schema changes due to schema upgrade

#### Redis modules

Redis Enterprise Software version 6.4.2-103 includes the following Redis Stack modules:

- [RediSearch v2.6.12]()

- [RedisJSON v2.4.7]()

- [RedisBloom v2.4.5]()

- [RedisGraph v2.10.12]()

- [RedisTimeSeries v1.8.11]()

title: Resolved issues

text:
- RS109744 - Fixed an issue where node removal sometimes got stuck in a `starting` state when `wait_for_persistence` was enabled.

- RS76441 - For databases created before Redis Enterprise Software v6.0.20, `crdt_syncer_auto_oom_unlatch` was `EMPTY` and `disabled` by default. `crdt_syncer_auto_oom_unlatch` is now enabled by default for new databases.

title: Version changes

role: compatibility

title: Supported platforms

text:
The following table provides a snapshot of supported platforms as of this Redis Enterprise Software release. See the [supported platforms reference]() for more details about operating system compatibility.

✅ Supported – The platform is supported for this version of Redis Enterprise Software.

⚠ Deprecated – The platform is still supported for this version of Redis Enterprise Software, but support will be removed in a future release.

❌ End of life – Platform support ended in this version of Redis Enterprise Software.

| Redis Enterprise | 7.2.4 | 6.4.2 | 6.2.18 | 6.2.12 | 6.2.10 | 6.2.8 | 6.2.4 |
|------------------|-------|-------|--------|--------|--------|--------|-------|
| **Release date** | Aug
2023 | Feb
2023 | Sept
2022 | Aug
2022 | Feb
2022 | Oct
2021 | Aug
2021 |
| [**End-of-life date**]() | – | Feb
2025 | Aug
2024 | Aug
2024 | Aug
2024 | Aug
2024 | Aug
2024 |
| **Ubuntu**[1](#table-note-1) |
| 20.04 | ✅ | ✅[6](#table-note-6) | – | – | – | – | – |
| 18.04 | ⚠ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| 16.04 | ❌ | ⚠ | ✅ | ✅ | ✅ | ✅ | ✅ |
| **RHEL & CentOS**[2](#table-note-2)
| 8.8 | ✅ | ✅[8](#table-note-8) | – | – | – | – | – |
| 8.7 | ✅ | ✅ | – | – | – | – | – |
| 8.5-8.6 | ✅ | ✅ | ✅ | ✅ | ✅ | – | – |
| 8.0-8.4 | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | – |
| 7.0-7.9 | ⚠ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| **Oracle Linux**[3](#table-note-3) |
| 8 | ✅ | ✅ | ✅ | ✅ | ✅ | – | – |
| 7 | ⚠ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| **Rocky Linux**[3](#table-note-3) |
| 8 | ✅ | ✅ | ✅ | – | – | – | – |
| **Amazon Linux** |
| 2 | ✅ | ✅[7](#table-note-7) | – | – | – | – | – |
| 1 | ⚠ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| **Docker**[4](#table-note-4) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| **Kubernetes**[5](#table-note-5) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |

1. The server version of Ubuntu is recommended for production installations. The desktop version is only recommended for development deployments.

2. RHEL and CentOS deployments require OpenSSL 1.0.2 and [firewall configuration]().

3. Based on the corresponding RHEL version.

4.
[Docker images]() of Redis Enterprise Software are certified for development and testing only.

5. See the [Redis Enterprise for Kubernetes documentation]().

6. Ubuntu 20.04 support was added in Redis Enterprise Software [6.4.2-43]().

7. A release candidate for Amazon Linux 2 support was added in Redis Enterprise Software [6.4.2-61](). Official support for Amazon Linux 2 was added in Redis Enterprise Software [6.4.2-69]().

8. Redis Enterprise Software [6.4.2-103]() and later supports RHEL 8.8.

title: Downloads

text:
The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-103 October release) |
|---------|---------------------------------------|
| Ubuntu 18 | 6544fd5d1625ab9da7b0d99f195fe4f1 |
| Ubuntu 20 | d623c8458a28f09a1e6ae0c0a8650023 |
| RedHat Enterprise Linux (RHEL) 7
Oracle Enterprise Linux (OL) 7 | 06cc49ddbf560c516c52ae721c2806cd |
| RedHat Enterprise Linux (RHEL) 8
Oracle Enterprise Linux (OL) 8
Rocky Enterprise Linux | 2d799af5ee03c0a94660a60cd99ea361 |
| Amazon Linux 2 | f2c5c2b5e879b8fd6792336f757593e2 |

title: Security

role: security

text:
#### Open source Redis security fixes compatibility

As part of Redis's commitment to security, Redis Enterprise Software implements the latest [security fixes](https://github.com/redis/redis/releases) available with [open source Redis](https://github.com/redis/redis). Redis Enterprise has already included the fixes for the relevant CVEs.

Some CVEs announced for open source Redis do not affect Redis Enterprise due to different or additional functionality available in Redis Enterprise that is not available in open source Redis.

Redis Enterprise 6.4.2-103 supports open source Redis 6.2 and 6.0. Below is the list of open source Redis CVEs fixed by version.

Redis 6.2.x:

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.2.12)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.2.11)

- (CVE-2023-22458) Integer overflow in the Redis `HRANDFIELD` and `ZRANDMEMBER` commands can lead to denial-of-service. (Redis 6.2.9)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. (Redis 6.2.11)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.2.9)

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.2.13)

- (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result in a crash of the `redis-server` process. This issue affects all versions of Redis. (Redis 6.2.7)

- (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. (Redis 6.2.7)

- (CVE-2021-41099) Integer to heap buffer overflow handling certain string commands and network payloads, when `proto-max-bulk-len` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32762) Integer to heap buffer overflow issue in `redis-cli` and `redis-sentinel` parsing large multi-bulk replies on some older and less common platforms. (Redis 6.2.6)

- (CVE-2021-32761) An integer overflow bug in Redis version 2.2 or newer can be exploited using the `BITFIELD` command to corrupt the heap and potentially result with remote code execution. (Redis 6.2.5)

- (CVE-2021-32687) Integer to heap buffer overflow with intsets, when `set-max-intset-entries` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections. (Redis 6.2.6)

- (CVE-2021-32672) Random heap reading issue with Lua Debugger. (Redis 6.2.6)

- (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for `hash-max-ziplist-entries`, `hash-max-ziplist-value`, `zset-max-ziplist-entries` or `zset-max-ziplist-value`. (Redis 6.2.6)

- (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for `proto-max-bulk-len` and `client-query-buffer-limit`. (Redis 6.2.6)

- (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow. (Redis 6.2.6)

- (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. (Redis 6.2.4)

- (CVE-2021-29478) An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a large set key that consists of integer values and using the COPY command to duplicate it. The integer overflow bug exists in all versions of Redis starting with 2.6, where it could result with a corrupted RDB or DUMP payload, but not exploited through COPY (which did not exist before 6.2). (Redis 6.2.3)

- (CVE-2021-29477) An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting with 6.0. (Redis 6.2.3)

Redis 6.0.x:

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.0.20)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.0.19)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.0.18)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. (Redis 6.0.18)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.0.17)


title: Overview

title: Highlights

text:
This version offers:

- RedisGraph v2.10.15

Redis has announced the end of life for RedisGraph. See the [announcement](https://redis.io/blog/redisgraph-eol/) for details.

- RedisBloom v2.4.8

- Bug fixes

title: New in this release

title: Enhancements

text:
#### Redis modules

Redis Enterprise Software version 6.4.2-110 includes the following Redis Stack modules:

- [RediSearch v2.6.12]()

- [RedisJSON v2.4.7]()

- [RedisBloom v2.4.8]()

- [RedisGraph v2.10.15]()

- [RedisTimeSeries v1.8.11]()

title: Resolved issues

text: - RS123237: CRDT syncer prevents potential data mismatches or data loss due to missing keys when removing and re-adding a cluster in an Active-Active setup with at least three participating clusters after removing older clusters without re-adding them.

title: Version changes

title: Supported platforms

text:
The following table provides a snapshot of supported platforms as of this Redis Enterprise Software release. See the [supported platforms reference]() for more details about operating system compatibility.

✅ Supported – The platform is supported for this version of Redis Enterprise Software and Redis Stack modules.

:warning: Deprecation warning – The platform is still supported for this version of Redis Enterprise Software, but support will be removed in a future release.

| Redis Enterprise
major versions | 7.4 | 7.2 | 6.4 | 6.2 |
|---------------------------------|:-----:|:-----:|:-----:|:-----:|
| **Release date** | Feb 2024 | Aug 2023 | Feb 2023 | Aug 2021 |
| [**End-of-life date**]() | Determined after
next major release | July 2025 | Feb 2025 | Aug 2024 |
| **Platforms** | | | | |
| RHEL 9 &
compatible distros[1](#table-note-1) | ✅ | – | – | – |
| RHEL 8 &
compatible distros[1](#table-note-1) | ✅ | ✅ | ✅ | ✅ |
| RHEL 7 &
compatible distros[1](#table-note-1) | – | :warning: | ✅ | ✅ |
| Ubuntu 20.04[2](#table-note-2) | ✅ | ✅ | ✅ | – |
| Ubuntu 18.04[2](#table-note-2) | :warning: | :warning: | :warning: | :warning: |
| Ubuntu 16.04[2](#table-note-2) | – | :warning: | :warning: | :warning: |
| Amazon Linux 2 | ✅ | ✅ | ✅ | – |
| Amazon Linux 1 | – | :warning: | :warning: | :warning: |
| Kubernetes[3](#table-note-3) | ✅ | ✅ | ✅ | ✅ |
| Docker[4](#table-note-4) | ✅ | ✅ | ✅ | ✅ |

1. The RHEL-compatible distributions CentOS, CentOS Stream, Alma, and Rocky are supported if they have full RHEL compatibility. Oracle Linux running the Red Hat Compatible Kernel (RHCK) is supported, but the Unbreakable Enterprise Kernel (UEK) is not supported.

2. The server version of Ubuntu is recommended for production installations. The desktop version is only recommended for development deployments.

3. See the [Redis Enterprise for Kubernetes documentation]() for details about support per version and Kubernetes distribution.

4.
[Docker images]() of Redis Enterprise Software are certified for development and testing only.

title: Downloads

text:
The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-110 May release) |
|---------|---------------------------------------|
| Ubuntu 16 | e61aab4bbb6837230451b70f8e0aa056 |
| Ubuntu 18 | 3180ea41e744acca860257dcef6c49c4 |
| Red Hat Enterprise Linux (RHEL) 7 | aaf0c1110f5ecc9ce55bf2935f2bcb73 |
| Red Hat Enterprise Linux (RHEL) 8 | d69894c4bc0860274973a4d78d53cb5d |
| Amazon Linux 2 | 19ac38908e47bd59c5890d1fc3bdba17 |

title: Security

text:
#### Open source Redis security fixes compatibility

As part of Redis's commitment to security, Redis Enterprise Software implements the latest [security fixes](https://github.com/redis/redis/releases) available with [open source Redis](https://github.com/redis/redis). Redis Enterprise has already included the fixes for the relevant CVEs.

Some CVEs announced for open source Redis do not affect Redis Enterprise due to different or additional functionality available in Redis Enterprise that is not available in open source Redis.

Redis Enterprise 6.4.2-110 supports open source Redis 6.2 and 6.0. Below is the list of open source Redis CVEs fixed by version.

Redis 6.2.x:

- (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.

- (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST`, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.

- (CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a
race condition that can be used by another process to bypass desired Unix
socket permissions on startup. (Redis 6.2.14)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.2.12)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.2.11)

- (CVE-2023-22458) Integer overflow in the Redis `HRANDFIELD` and `ZRANDMEMBER` commands can lead to denial-of-service. (Redis 6.2.9)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. (Redis 6.2.11)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.2.9)

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.2.13)

- (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result in a crash of the `redis-server` process. This issue affects all versions of Redis. (Redis 6.2.7)

- (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. (Redis 6.2.7)

- (CVE-2021-41099) Integer to heap buffer overflow handling certain string commands and network payloads, when `proto-max-bulk-len` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32762) Integer to heap buffer overflow issue in `redis-cli` and `redis-sentinel` parsing large multi-bulk replies on some older and less common platforms. (Redis 6.2.6)

- (CVE-2021-32761) An integer overflow bug in Redis version 2.2 or newer can be exploited using the `BITFIELD` command to corrupt the heap and potentially result with remote code execution. (Redis 6.2.5)

- (CVE-2021-32687) Integer to heap buffer overflow with intsets, when `set-max-intset-entries` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections. (Redis 6.2.6)

- (CVE-2021-32672) Random heap reading issue with Lua Debugger. (Redis 6.2.6)

- (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for `hash-max-ziplist-entries`, `hash-max-ziplist-value`, `zset-max-ziplist-entries` or `zset-max-ziplist-value`. (Redis 6.2.6)

- (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for `proto-max-bulk-len` and `client-query-buffer-limit`. (Redis 6.2.6)

- (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow. (Redis 6.2.6)

- (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. (Redis 6.2.4)

- (CVE-2021-29478) An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a large set key that consists of integer values and using the COPY command to duplicate it. The integer overflow bug exists in all versions of Redis starting with 2.6, where it could result with a corrupted RDB or DUMP payload, but not exploited through COPY (which did not exist before 6.2). (Redis 6.2.3)

- (CVE-2021-29477) An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting with 6.0. (Redis 6.2.3)

Redis 6.0.x:

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.0.20)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.0.19)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.0.18)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. (Redis 6.0.18)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.0.17)


title: Overview

title: Highlights

text:
This version offers:

- RediSearch v2.6.23

- RedisBloom v2.4.12

- RedisTimeSeries v1.8.15

title: New in this release

title: Enhancements

text:
#### Redis modules

Redis Enterprise Software version 6.4.2-115 includes the following Redis Stack modules:

- [RediSearch v2.6]()

- [RedisJSON v2.4]()

- [RedisBloom v2.4]()

- [RedisGraph v2.10]()

- [RedisTimeSeries v1.8]()

title: Version changes

title: Supported platforms

text:
The following table provides a snapshot of supported platforms as of this Redis Enterprise Software release. See the [supported platforms reference]() for more details about operating system compatibility.

✅ Supported – The platform is supported for this version of Redis Enterprise Software and Redis Stack modules.

:warning: Deprecation warning – The platform is still supported for this version of Redis Enterprise Software, but support will be removed in a future release.

| Redis Enterprise
major versions | 7.4 | 7.2 | 6.4 | 6.2 |
|---------------------------------|:-----:|:-----:|:-----:|:-----:|
| **Release date** | Feb 2024 | Aug 2023 | Feb 2023 | Aug 2021 |
| [**End-of-life date**]() | Determined after
next major release | Feb 2026 | Aug 2025 | Feb 2025 |
| **Platforms** | | | | |
| RHEL 9 &
compatible distros[1](#table-note-1) | ✅ | – | – | – |
| RHEL 8 &
compatible distros[1](#table-note-1) | ✅ | ✅ | ✅ | ✅ |
| RHEL 7 &
compatible distros[1](#table-note-1) | – | :warning: | ✅ | ✅ |
| Ubuntu 20.04[2](#table-note-2) | ✅ | ✅ | ✅ | – |
| Ubuntu 18.04[2](#table-note-2) | :warning: | :warning: | :warning: | :warning: |
| Ubuntu 16.04[2](#table-note-2) | – | :warning: | :warning: | :warning: |
| Amazon Linux 2 | ✅ | ✅ | ✅ | – |
| Amazon Linux 1 | – | :warning: | :warning: | :warning: |
| Kubernetes[3](#table-note-3) | ✅ | ✅ | ✅ | ✅ |
| Docker[4](#table-note-4) | ✅ | ✅ | ✅ | ✅ |

1. The RHEL-compatible distributions CentOS, CentOS Stream, Alma, and Rocky are supported if they have full RHEL compatibility. Oracle Linux running the Red Hat Compatible Kernel (RHCK) is supported, but the Unbreakable Enterprise Kernel (UEK) is not supported.

2. The server version of Ubuntu is recommended for production installations. The desktop version is only recommended for development deployments.

3. See the [Redis Enterprise for Kubernetes documentation]() for details about support per version and Kubernetes distribution.

4.
[Docker images]() of Redis Enterprise Software are certified for development and testing only.

title: Downloads

text:
The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-115 Oct release) |
|---------|---------------------------------------|
| Ubuntu 16 | 5fb2186abb6c87efebd987ebf827b949 |
| Ubuntu 18 | e8a938c7125fbc7d7f85f0e19d4afafb |
| Red Hat Enterprise Linux (RHEL) 7 | dc646920043bd888299726027d9e9216 |
| Red Hat Enterprise Linux (RHEL) 8 | 54574ca69f2966f7361f281f1ea3b312 |
| Amazon Linux 2 | 8315ba719f1549e8bf423a9db004d49c |

title: Security

text:
#### Open source Redis security fixes compatibility

As part of Redis's commitment to security, Redis Enterprise Software implements the latest [security fixes](https://github.com/redis/redis/releases) available with [open source Redis](https://github.com/redis/redis). Redis Enterprise has already included the fixes for the relevant CVEs.

Some CVEs announced for open source Redis do not affect Redis Enterprise due to different or additional functionality available in Redis Enterprise that is not available in open source Redis.

Redis Enterprise 6.4.2-115 supports open source Redis 6.2 and 6.0. Below is the list of open source Redis CVEs fixed by version.

Redis 6.2.x:

- (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.

- (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST`, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.

- (CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a
race condition that can be used by another process to bypass desired Unix
socket permissions on startup. (Redis 6.2.14)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.2.12)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.2.11)

- (CVE-2023-22458) Integer overflow in the Redis `HRANDFIELD` and `ZRANDMEMBER` commands can lead to denial-of-service. (Redis 6.2.9)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, can cause it to hang and consume 100% CPU time. (Redis 6.2.11)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.2.9)

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.2.13)

- (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result in a crash of the `redis-server` process. This issue affects all versions of Redis. (Redis 6.2.7)

- (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. (Redis 6.2.7)

- (CVE-2021-41099) Integer to heap buffer overflow can occur when handling certain string commands and network payloads, when `proto-max-bulk-len` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32762) Integer to heap buffer overflow issue in `redis-cli` and `redis-sentinel` can occur when parsing large multi-bulk replies on some older and less common platforms. (Redis 6.2.6)

- (CVE-2021-32761) An integer overflow bug in Redis version 2.2 or newer can be exploited using the `BITFIELD` command to corrupt the heap and potentially result with remote code execution. (Redis 6.2.5)

- (CVE-2021-32687) Integer to heap buffer overflow with intsets, when `set-max-intset-entries` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections. (Redis 6.2.6)

- (CVE-2021-32672) Random heap reading issue with Lua Debugger. (Redis 6.2.6)

- (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for `hash-max-ziplist-entries`, `hash-max-ziplist-value`, `zset-max-ziplist-entries` or `zset-max-ziplist-value`. (Redis 6.2.6)

- (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for `proto-max-bulk-len` and `client-query-buffer-limit`. (Redis 6.2.6)

- (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow. (Redis 6.2.6)

- (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. (Redis 6.2.4)

- (CVE-2021-29478) An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a large set key that consists of integer values and using the COPY command to duplicate it. The integer overflow bug exists in all versions of Redis starting with 2.6, where it could result with a corrupted RDB or DUMP payload, but not exploited through COPY (which did not exist before 6.2). (Redis 6.2.3)

- (CVE-2021-29477) An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting with 6.0. (Redis 6.2.3)

Redis 6.0.x:

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.0.20)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.0.19)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.0.18)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. (Redis 6.0.18)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.0.17)


summary: Internal fixes and improvements.

title: Overview

text: This is a maintenance release for [Redis Enterprise Software version 6.4.2](https://redis.io/downloads/#software).

title: Highlights

text:
This version offers:

- Internal fixes and improvements

title: New in this release

text:
#### Redis modules

Redis Enterprise Software version 6.4.2-121 includes the following Redis Stack modules:

- [RediSearch v2.6]()

- [RedisJSON v2.4]()

- [RedisBloom v2.4]()

- [RedisGraph v2.10]()

- [RedisTimeSeries v1.8]()

title: Version changes

title: Supported platforms

text:
The following table provides a snapshot of supported platforms as of this Redis Software release. See the [supported platforms reference]() for more details about operating system compatibility.

✅ Supported – The platform is supported for this version of Redis Software and Redis Stack modules.

:warning: Deprecation warning – The platform is still supported for this version of Redis Software, but support will be removed in a future release.

| Redis Software
major versions | 7.8 | 7.4 | 7.2 | 6.4 | 6.2 |
|---------------------------------|:-----:|:-----:|:-----:|:-----:|:-----:|
| **Release date** | Nov 2024 | Feb 2024 | Aug 2023 | Feb 2023 | Aug 2021 |
| [**End-of-life date**]() | Determined after
next major release | Nov 2026 | Feb 2026 | Aug 2025 | Feb 2025 |
| **Platforms** | | | | | |
| RHEL 9 &
compatible distros[1](#table-note-1) | ✅ | ✅ | – | – | – |
| RHEL 9
FIPS mode[5](#table-note-5) | ✅ | – | – | – | – |
| RHEL 8 &
compatible distros[1](#table-note-1) | ✅ | ✅ | ✅ | ✅ | ✅ |
| RHEL 7 &
compatible distros[1](#table-note-1) | – | – | :warning: | ✅ | ✅ |
| Ubuntu 22.04[2](#table-note-2) | ✅ | – | – | – | – |
| Ubuntu 20.04[2](#table-note-2) | ✅ | ✅ | ✅ | ✅ | – |
| Ubuntu 18.04[2](#table-note-2) | – | :warning: | :warning: | :warning: | :warning: |
| Ubuntu 16.04[2](#table-note-2) | – | – | :warning: | :warning: | :warning: |
| Amazon Linux 2 | ✅ | ✅ | ✅ | ✅ | – |
| Amazon Linux 1 | – | – | :warning: | :warning: | :warning: |
| Kubernetes[3](#table-note-3) | ✅ | ✅ | ✅ | ✅ | ✅ |
| Docker[4](#table-note-4) | ✅ | ✅ | ✅ | ✅ | ✅ |

1. The RHEL-compatible distributions CentOS, CentOS Stream, Alma, and Rocky are supported if they have full RHEL compatibility. Oracle Linux running the Red Hat Compatible Kernel (RHCK) is supported, but the Unbreakable Enterprise Kernel (UEK) is not supported.

2. The server version of Ubuntu is recommended for production installations. The desktop version is only recommended for development deployments.

3. See the [Redis Enterprise for Kubernetes documentation]() for details about support per version and Kubernetes distribution.

4. [Docker images]() of Redis Software are certified for development and testing only.

5. Supported only if [FIPS was enabled during RHEL installation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/switching-rhel-to-fips-mode_security-hardening#proc_installing-the-system-with-fips-mode-enabled_switching-rhel-to-fips-mode) to ensure FIPS compliance.

title: Downloads

text:
The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-121 March release) |
|---------|---------------------------------------|
| Ubuntu 16 | 251324d7ee04b524e0e08d3ddb6e2723 |
| Ubuntu 18 | fb7e0931e75174cc8433cb7f4c9b3b15 |
| Ubuntu 20 | 1e6abb275aa9a44246571313a46f391a |
| Red Hat Enterprise Linux (RHEL) 7 | 3da1cf1c73c2bb116b4d09456f8693bd |
| Red Hat Enterprise Linux (RHEL) 8 | 8b06790eb63d769216e87c183a5a64e1 |
| Amazon Linux 2 | 3ff40b912c0f5de632fa3a144f6a77e9 |

title: Security

text:
#### Open source Redis security fixes compatibility

As part of Redis's commitment to security, Redis Enterprise Software implements the latest [security fixes](https://github.com/redis/redis/releases) available with [open source Redis](https://github.com/redis/redis). Redis Enterprise has already included the fixes for the relevant CVEs.

Some CVEs announced for open source Redis do not affect Redis Enterprise due to different or additional functionality available in Redis Enterprise that is not available in open source Redis.

Redis Enterprise 6.4.2-121 supports open source Redis 6.2 and 6.0. Below is the list of open source Redis CVEs fixed by version.

Redis 6.2.x:

- (CVE-2025-21605) An unauthenticated client can cause unlimited growth of output buffers until the server runs out of memory or is terminated, which can lead to denial-of-service.

- (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.

- (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST`, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.

- (CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a
race condition that can be used by another process to bypass desired Unix
socket permissions on startup. (Redis 6.2.14)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.2.12)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.2.11)

- (CVE-2023-22458) Integer overflow in the Redis `HRANDFIELD` and `ZRANDMEMBER` commands can lead to denial-of-service. (Redis 6.2.9)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, can cause it to hang and consume 100% CPU time. (Redis 6.2.11)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.2.9)

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.2.13)

- (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result in a crash of the `redis-server` process. This issue affects all versions of Redis. (Redis 6.2.7)

- (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. (Redis 6.2.7)

- (CVE-2021-41099) Integer to heap buffer overflow can occur when handling certain string commands and network payloads, when `proto-max-bulk-len` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32762) Integer to heap buffer overflow issue in `redis-cli` and `redis-sentinel` can occur when parsing large multi-bulk replies on some older and less common platforms. (Redis 6.2.6)

- (CVE-2021-32761) An integer overflow bug in Redis version 2.2 or newer can be exploited using the `BITFIELD` command to corrupt the heap and potentially result with remote code execution. (Redis 6.2.5)

- (CVE-2021-32687) Integer to heap buffer overflow with intsets, when `set-max-intset-entries` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections. (Redis 6.2.6)

- (CVE-2021-32672) Random heap reading issue with Lua Debugger. (Redis 6.2.6)

- (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for `hash-max-ziplist-entries`, `hash-max-ziplist-value`, `zset-max-ziplist-entries` or `zset-max-ziplist-value`. (Redis 6.2.6)

- (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for `proto-max-bulk-len` and `client-query-buffer-limit`. (Redis 6.2.6)

- (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow. (Redis 6.2.6)

- (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. (Redis 6.2.4)

- (CVE-2021-29478) An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a large set key that consists of integer values and using the COPY command to duplicate it. The integer overflow bug exists in all versions of Redis starting with 2.6, where it could result with a corrupted RDB or DUMP payload, but not exploited through COPY (which did not exist before 6.2). (Redis 6.2.3)

- (CVE-2021-29477) An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting with 6.0. (Redis 6.2.3)

Redis 6.0.x:

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.0.20)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.0.19)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.0.18)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. (Redis 6.0.18)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.0.17)


summary: Internal fixes and improvements.

title: Overview

title: Highlights

title: New in this release

title: Redis modules

text:
Redis Enterprise Software version 6.4.2-127 includes the following Redis Stack modules:

- [RediSearch v2.6]()

- [RedisJSON v2.4]()

- [RedisBloom v2.4]()

- [RedisGraph v2.10]()

- [RedisTimeSeries v1.8]()

title: Version changes

title: Supported platforms

text:
The following table provides a snapshot of supported platforms as of this Redis Software release. See the [supported platforms reference]() for more details about operating system compatibility.

✅ Supported – The platform is supported for this version of Redis Enterprise Software and Redis Stack modules.

:warning: Deprecation warning – The platform is still supported for this version of Redis Enterprise Software, but support will be removed in a future release.

| Redis Software
major versions | 7.22 | 7.8 | 7.4 | 7.2 | 6.4 | 6.2 |
|---------------------------------|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|
| **Release date** | May 2025 | Nov 2024 | Feb 2024 | Aug 2023 | Feb 2023 | Aug 2021 |
| [**End-of-life date**]() | Determined after
next major release | May 2027 | Nov 2026 | Feb 2026 | Aug 2025 | Feb 2025 |
| **Platforms** | | | | | | |
| RHEL 9 &
compatible distros[1](#table-note-1) | ✅ | ✅ | ✅ | – | – | – |
| RHEL 9
FIPS mode[5](#table-note-5) | ✅ | ✅ | – | – | – | – |
| RHEL 8 &
compatible distros[1](#table-note-1) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| RHEL 7 &
compatible distros[1](#table-note-1) | – | – | – | :warning: | ✅ | ✅ |
| Ubuntu 22.04[2](#table-note-2) | ✅ | ✅ | – | – | – | – |
| Ubuntu 20.04[2](#table-note-2) | ✅ | ✅ | ✅ | ✅ | ✅ | – |
| Ubuntu 18.04[2](#table-note-2) | – | – | :warning: | :warning: | :warning: | :warning: |
| Ubuntu 16.04[2](#table-note-2) | – | – | – | :warning: | :warning: | :warning: |
| Amazon Linux 2 | ✅ | ✅ | ✅ | ✅ | ✅ | – |
| Amazon Linux 1 | – | – | – | :warning: | :warning: | :warning: |
| Kubernetes[3](#table-note-3) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Docker[4](#table-note-4) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |

1. The RHEL-compatible distributions CentOS, CentOS Stream, Alma, and Rocky are supported if they have full RHEL compatibility. Oracle Linux running the Red Hat Compatible Kernel (RHCK) is supported, but the Unbreakable Enterprise Kernel (UEK) is not supported.

2. The server version of Ubuntu is recommended for production installations. The desktop version is only recommended for development deployments.

3. See the [Redis Enterprise for Kubernetes documentation]() for details about support per version and Kubernetes distribution.

4. [Docker images]() of Redis Enterprise Software are certified for development and testing only.

5. Supported only if [FIPS was enabled during RHEL installation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/switching-rhel-to-fips-mode_security-hardening#proc_installing-the-system-with-fips-mode-enabled_switching-rhel-to-fips-mode) to ensure FIPS compliance.

title: Downloads

text:
The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-127 June release) |
|---------|---------------------------------------|
| Ubuntu 16 | a7f5838f86a08bdc9bdac7cefdb45b5d |
| Ubuntu 18 | ca5e7852ce6f85aa5d7e6d31df6eba62 |
| Ubuntu 20 | a88ca5b0a38f7cac661a873c2a02fb3d |
| Red Hat Enterprise Linux (RHEL) 7 | 58ab0ba78bd2752607cbc0f1e5ae0900 |
| Red Hat Enterprise Linux (RHEL) 8 | 75c885e70bff697e33733783ff488a97 |
| Amazon Linux 2 | cb8ba0e4105dd926b8709dfd20d31cee |

title: Security

text:
#### Open source Redis security fixes compatibility

As part of Redis's commitment to security, Redis Enterprise Software implements the latest [security fixes](https://github.com/redis/redis/releases) available with [open source Redis](https://github.com/redis/redis). Redis Enterprise has already included the fixes for the relevant CVEs.

Some CVEs announced for open source Redis do not affect Redis Enterprise due to different or additional functionality available in Redis Enterprise that is not available in open source Redis.

Redis Enterprise 6.4.2-127 supports open source Redis 6.2 and 6.0. Below is the list of open source Redis CVEs fixed by version.

Redis 6.2.x:

- (CVE-2025-32023) An authenticated user can use a specially crafted string to trigger a stack/heap out-of-bounds write on HyperLogLog operations, which can lead to remote code execution.

- (CVE-2025-21605) An unauthenticated client can cause unlimited growth of output buffers until the server runs out of memory or is terminated, which can lead to denial-of-service.

- (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.

- (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST`, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.

- (CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a
race condition that can be used by another process to bypass desired Unix
socket permissions on startup. (Redis 6.2.14)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.2.12)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.2.11)

- (CVE-2023-22458) Integer overflow in the Redis `HRANDFIELD` and `ZRANDMEMBER` commands can lead to denial-of-service. (Redis 6.2.9)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, can cause it to hang and consume 100% CPU time. (Redis 6.2.11)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.2.9)

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.2.13)

- (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result in a crash of the `redis-server` process. This issue affects all versions of Redis. (Redis 6.2.7)

- (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. (Redis 6.2.7)

- (CVE-2021-41099) Integer to heap buffer overflow can occur when handling certain string commands and network payloads, when `proto-max-bulk-len` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32762) Integer to heap buffer overflow issue in `redis-cli` and `redis-sentinel` can occur when parsing large multi-bulk replies on some older and less common platforms. (Redis 6.2.6)

- (CVE-2021-32761) An integer overflow bug in Redis version 2.2 or newer can be exploited using the `BITFIELD` command to corrupt the heap and potentially result with remote code execution. (Redis 6.2.5)

- (CVE-2021-32687) Integer to heap buffer overflow with intsets, when `set-max-intset-entries` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections. (Redis 6.2.6)

- (CVE-2021-32672) Random heap reading issue with Lua Debugger. (Redis 6.2.6)

- (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for `hash-max-ziplist-entries`, `hash-max-ziplist-value`, `zset-max-ziplist-entries` or `zset-max-ziplist-value`. (Redis 6.2.6)

- (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for `proto-max-bulk-len` and `client-query-buffer-limit`. (Redis 6.2.6)

- (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow. (Redis 6.2.6)

- (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. (Redis 6.2.4)

- (CVE-2021-29478) An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a large set key that consists of integer values and using the COPY command to duplicate it. The integer overflow bug exists in all versions of Redis starting with 2.6, where it could result with a corrupted RDB or DUMP payload, but not exploited through COPY (which did not exist before 6.2). (Redis 6.2.3)

- (CVE-2021-29477) An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting with 6.0. (Redis 6.2.3)

Redis 6.0.x:

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.0.20)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.0.19)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.0.18)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. (Redis 6.0.18)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.0.17)


summary: Internal fixes and improvements.

title: Overview

text: This is a maintenance release for Redis Enterprise Software version 6.4.2.

title: Highlights

title: New in this release

title: Redis modules

text:
Redis Enterprise Software version 6.4.2-131 includes the following Redis Stack modules:

- [RediSearch v2.6]()

- [RedisJSON v2.4]()

- [RedisBloom v2.4]()

- [RedisGraph v2.10]()

- [RedisTimeSeries v1.8]()

title: Version changes

title: Supported platforms

text:
The following table provides a snapshot of supported platforms as of this Redis Software release. See the [supported platforms reference]() for more details about operating system compatibility.

✅ Supported – The platform is supported for this version of Redis Enterprise Software and Redis Stack modules.

:warning: Deprecation warning – The platform is still supported for this version of Redis Enterprise Software, but support will be removed in a future release.

| Redis Software
major versions | 7.22 | 7.8 | 7.4 | 7.2 | 6.4 | 6.2 |
|---------------------------------|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|
| **Release date** | May 2025 | Nov 2024 | Feb 2024 | Aug 2023 | Feb 2023 | Aug 2021 |
| [**End-of-life date**]() | Determined after
next major release | May 2027 | Nov 2026 | Feb 2026 | Aug 2025 | Feb 2025 |
| **Platforms** | | | | | | |
| RHEL 9 &
compatible distros[1](#table-note-1) | ✅ | ✅ | ✅ | – | – | – |
| RHEL 9
FIPS mode[5](#table-note-5) | ✅ | ✅ | – | – | – | – |
| RHEL 8 &
compatible distros[1](#table-note-1) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| RHEL 7 &
compatible distros[1](#table-note-1) | – | – | – | :warning: | :warning: | :warning: |
| Ubuntu 22.04[2](#table-note-2) | ✅ | ✅ | – | – | – | – |
| Ubuntu 20.04[2](#table-note-2) | ✅ | ✅ | ✅ | ✅ | ✅ | – |
| Ubuntu 18.04[2](#table-note-2) | – | – | :warning: | :warning: | :warning: | :warning: |
| Ubuntu 16.04[2](#table-note-2) | – | – | – | :warning: | :warning: | :warning: |
| Amazon Linux 2 | ✅ | ✅ | ✅ | ✅ | ✅ | – |
| Amazon Linux 1 | – | – | – | :warning: | :warning: | :warning: |
| Kubernetes[3](#table-note-3) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Docker[4](#table-note-4) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |

1. The RHEL-compatible distributions CentOS, CentOS Stream, Alma, and Rocky are supported if they have full RHEL compatibility. Oracle Linux running the Red Hat Compatible Kernel (RHCK) is supported, but the Unbreakable Enterprise Kernel (UEK) is not supported.

2. The server version of Ubuntu is recommended for production installations. The desktop version is only recommended for development deployments.

3. See the [Redis Enterprise for Kubernetes documentation]() for details about support per version and Kubernetes distribution.

4. [Docker images]() of Redis Enterprise Software are certified for development and testing only.

5. Supported only if [FIPS was enabled during RHEL installation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/switching-rhel-to-fips-mode_security-hardening#proc_installing-the-system-with-fips-mode-enabled_switching-rhel-to-fips-mode) to ensure FIPS compliance.

title: Downloads

text:
The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-131 September release) |
|---------|---------------------------------------|
| Ubuntu 18 | acdb7e4623d17f653985e52e87de98a4 |
| Ubuntu 20 | 076aceab8f51f27e8061f8fe40d13869 |
| Red Hat Enterprise Linux (RHEL) 8 | 689b8b362e93bd83df161b5c6da4bf0d |
| Amazon Linux 2 | 75d9b521f4a1aabeb9a5a16f6a1e9fd8 |

title: Security

text:
#### Open source Redis security fixes compatibility

As part of Redis's commitment to security, Redis Enterprise Software implements the latest [security fixes](https://github.com/redis/redis/releases) available with [open source Redis](https://github.com/redis/redis). Redis Enterprise has already included the fixes for the relevant CVEs.

Some CVEs announced for open source Redis do not affect Redis Enterprise due to different or additional functionality available in Redis Enterprise that is not available in open source Redis.

Redis Enterprise 6.4.2-131 supports open source Redis 6.2 and 6.0. Below is the list of open source Redis CVEs and other security vulnerabilities fixed by version.

Redis 6.2.x:

- RedisBloom: Cuckoo filter counter overflow.

- RedisBloom: Invalid Bloom filters can cause arbitrary memory reads and writes.

- RedisBloom: Reachable assert in `TopK_Create`

- RedisBloom: Out-of-bounds access with empty Bloom chains.

- RedisBloom: Division by zero in Cuckoo filter insertion.

- (CVE-2025-46818) An authenticated user may use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user.

- (CVE-2025-46819) An authenticated user may use a specially crafted LUA script to read out-of-bound data or crash the server and lead to subsequent denial of service.

- (CVE-2025-46817) An authenticated user may use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution.

- (CVE-2025-49844) An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution.

- (CVE-2025-32023) An authenticated user can use a specially crafted string to trigger a stack/heap out-of-bounds write on HyperLogLog operations, which can lead to remote code execution.

- (CVE-2025-21605) An unauthenticated client can cause unlimited growth of output buffers until the server runs out of memory or is terminated, which can lead to denial-of-service.

- (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.

- (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST`, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.

- (CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a
race condition that can be used by another process to bypass desired Unix
socket permissions on startup. (Redis 6.2.14)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.2.12)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.2.11)

- (CVE-2023-22458) Integer overflow in the Redis `HRANDFIELD` and `ZRANDMEMBER` commands can lead to denial-of-service. (Redis 6.2.9)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, can cause it to hang and consume 100% CPU time. (Redis 6.2.11)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.2.9)

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.2.13)

- (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result in a crash of the `redis-server` process. This issue affects all versions of Redis. (Redis 6.2.7)

- (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. (Redis 6.2.7)

- (CVE-2021-41099) Integer to heap buffer overflow can occur when handling certain string commands and network payloads, when `proto-max-bulk-len` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32762) Integer to heap buffer overflow issue in `redis-cli` and `redis-sentinel` can occur when parsing large multi-bulk replies on some older and less common platforms. (Redis 6.2.6)

- (CVE-2021-32761) An integer overflow bug in Redis version 2.2 or newer can be exploited using the `BITFIELD` command to corrupt the heap and potentially result with remote code execution. (Redis 6.2.5)

- (CVE-2021-32687) Integer to heap buffer overflow with intsets, when `set-max-intset-entries` is manually configured to a non-default, very large value. (Redis 6.2.6)

- (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections. (Redis 6.2.6)

- (CVE-2021-32672) Random heap reading issue with Lua Debugger. (Redis 6.2.6)

- (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for `hash-max-ziplist-entries`, `hash-max-ziplist-value`, `zset-max-ziplist-entries` or `zset-max-ziplist-value`. (Redis 6.2.6)

- (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for `proto-max-bulk-len` and `client-query-buffer-limit`. (Redis 6.2.6)

- (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow. (Redis 6.2.6)

- (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. (Redis 6.2.4)

- (CVE-2021-29478) An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a large set key that consists of integer values and using the COPY command to duplicate it. The integer overflow bug exists in all versions of Redis starting with 2.6, where it could result with a corrupted RDB or DUMP payload, but not exploited through COPY (which did not exist before 6.2). (Redis 6.2.3)

- (CVE-2021-29477) An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting with 6.0. (Redis 6.2.3)

Redis 6.0.x:

- RedisBloom: Cuckoo filter counter overflow.

- RedisBloom: Invalid Bloom filters can cause arbitrary memory reads and writes.

- RedisBloom: Reachable assert in `TopK_Create`

- RedisBloom: Out-of-bounds access with empty Bloom chains.

- RedisBloom: Division by zero in Cuckoo filter insertion.

- (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.0.20)

- (CVE-2023-28856) Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access. (Redis 6.0.19)

- (CVE-2023-25155) Specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.0.18)

- (CVE-2022-36021) String matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. (Redis 6.0.18)

- (CVE-2022-35977) Integer overflow in the Redis `SETRANGE` and `SORT`/`SORT_RO` commands can drive Redis to OOM panic. (Redis 6.0.17)


summary: Pub/sub ACLs & default permissions. Validate client certificates by subject attributes.

title: Overview

text:
[Redis Enterprise Software version 6.4.2](https://redis.io/downloads/#software) is now available!

This version offers:

- Extended validation of client certificates via mTLS (mutual TLS) full subject support

- Support for default restrictive permissions when using publish/subscribe commands and ACLs (access control lists)

- Enhanced TLS performance when Redis returns large arrays in responses

- Compatibility with [open source Redis 6.2.7](https://github.com/redis/redis)

- Additional enhancements and bug fixes

The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-30 February release) |
|---------|---------------------------------------|
| Ubuntu 16 | b0dbecaa974ca08245dda55d53b6fe9b |
| Ubuntu 18 | a5192e8b0734db80d6b7c2b98a170c58 |
| RedHat Enterprise Linux (RHEL) 7
Oracle Enterprise Linux (OL) 7 | c1537855dcfe7a7cedf9031ce01e2b9b |
| RedHat Enterprise Linux (RHEL) 8
Oracle Enterprise Linux (OL) 8
Rocky Enterprise Linux | a24dc749d6dcb5df2162d7a41791c7aa |

title: New features and enhancements

text:
#### Validate client certificates by subject attributes

You can now validate client certificates by their `Subject` attributes. When a client attempts to connect to a database, Redis Enterprise Software compares the values of the client certificate subject attributes to the subject values allowed by the database. Clients can connect to the database only if the subject values match. This gives more flexibility in controlling which clients can access which databases.

See [Enable TLS]() for more information.

#### Default pub/sub ACL permissions

Redis is continuously enhancing its ACL (access control list) functionality and coverage. Redis version 6.2 enhances [ACLs]() to allow and disallow pub/sub channels.

Part of protecting pub/sub channels requires changing the default access from permissive to restrictive, which blocks all pub/sub channels unless specifically permitted by an ACL rule. To allow this transition across all databases in the cluster, Redis Enterprise Software 6.4.2 provides a new configuration option `acl-pubsub-default` that sets the cluster-wide default for all channels to either permitted or restricted.

The 6.4.2 installation-provided value of `acl-pubsub-default` is permissive (`allchannels`) to comply with earlier Redis versions. After you upgrade all databases in the cluster to Redis DB version 6.2 (or later in future versions), you can use `rladmin` or the REST API to change the value to restrictive (`resetchannels`).

To allow certain users to access specific pub/sub channels, define the appropriate ACL. Redis Enterprise Software 6.4.2 enhances the admin console (UI), CLI, and REST API to support pub/sub channel ACL definitions.

If you use ACLs and pub/sub channels, we recommend you review your databases and ACL settings and plan to change your cluster to restricted mode. This will help you prepare for future Redis Enterprise Software releases that use restrictive `resetchannels` as the new default for `acl-pubsub-default`.

#### Redis modules

Redis Enterprise Software v6.4.2 includes the following Redis modules:

- [RediSearch v2.4.16]()

- [RedisJSON v2.2.0]()

- [RedisBloom v2.2.18](release-notes/redisbloom-2.2-release-notes/#v2218-july-2022)

- [RedisGraph v2.8.20]()

- [RedisTimeSeries v1.6.17]()

See [Upgrade modules]() to learn how to upgrade a module for a database.

#### Installations, upgrades, and troubleshooting

- Added the ability for `install.sh` to run even if "upgrade mode" is already enabled to allow reruns in case of a previous run failure (RS77319)

- Added log messages to the `redis_mgr` process (RS77891), the job_scheduler process (RS82673), and the `install.sh` script (RS82673)

- Improved `rladmin` error messages for certificate validation (RS79933)

- Added internode encryption ports to command-line utility `rlcheck` validation (RS68965)

- Added an alert to notify when a node operation (such as maintenance mode) failed, aborted, or was canceled. The alert is enabled by default (RS76089)

title: Version changes

title: Breaking changes

text: - REST API: the `authorized_names` field of the [BDB object]() is deprecated. Use the new `authorized_subjects` field instead.

title: New default Redis DB version

text:
Both Redis Enterprise Software versions 6.2.x and 6.4.x package two Redis DB versions: Redis DB 6.0 and Redis DB 6.2. Until now, the default Redis DB version for creating new databases and upgrading existing databases was 6.0 (enforced by the `redis_upgrade_policy` parameter).

To allow customers more flexibility in future upgrades, starting with Redis Enterprise Software 6.4.2, the default Redis DB version for new and upgraded databases is now 6.2 for all upgrade policies (`redis_upgrade_policy=major` and `redis_upgrade_policy=latest`).

| Redis
Enterprise | Bundled Redis
DB versions | Default DB version
(upgraded/new databases) |
|-------|----------|-----|
| 6.2.x | 6.0, 6.2 | 6.0 |
| 6.4.2 | 6.0, 6.2 | 6.2 |

You can override the default version with [`rladmin`](#tune-cluster); however, we recommend that you don't change this setting.

title: Deprecations

text:
#### Ubuntu 16.04

Ubuntu 16 support is considered deprecated and will be removed in a future release. Ubuntu 16.04 LTS (Xenial) has reached the end of its free initial five-year security maintenance period as of April 30, 2021.

#### Active-Active database persistence

The snapshot option for Active-Active database persistence is deprecated. We advise customers running Active-Active databases, configured with snapshot data persistence, to reconfigure their data persistence mode to use the AOF (Append Only File) option with the following command:

[code example]

#### TLS 1.0 and TLS 1.1

TLS 1.0 and TLS 1.1 connections are considered deprecated in favor of TLS 1.2 or later.
Please verify that all clients, apps, and connections support TLS 1.2. Support for the earlier protocols will be removed in a future release.
Certain operating systems, such as RHEL 8, have already removed support for the earlier protocols. Redis Enterprise Software cannot support connection protocols that are not supported by the underlying operating system.

#### 3DES encryption cipher

The 3DES encryption cipher is considered deprecated in favor of stronger ciphers like AES.
Please verify that all clients, apps, and connections support the AES cipher. Support for 3DES will be removed in a future release.
Certain operating systems, such as RHEL 8, have already removed support for 3DES. Redis Enterprise Software cannot support cipher suites that are not supported by the underlying operating system.

title: Resolved issues

text:
- RS72866 - Improved performance for client connections which use TLS

- RS78241 - Fixed shard placement to always respect rack-zone restrictions and avoid a state where a primary (master) and replica are on the same rack, even if temporarily

- RS78144 - Removed the dependency on system-wide `ldconfig` so non-interactive processes will use their own dynamic libraries without impacting external services

- RS78028 - Fixed race condition during rolling upgrade that might result in shards repeatedly restarting

- RS77964 - Fixed module deletion to remove the old directory with the module

- RS75259 - Fixed node to prevent using plain text communication instead of TLS after losing connectivity

- RS69616 - Fixed validation for internode communication ports

- RS83535 - Fixed `sentinel_service` to start on RHEL 8 with DISA STIG profile

- RS87191 - Fixed a cross slot error when using Auto Tiering with Replica Of, in case a key on the source database swapped from RAM to flash and expired while it was also part of Lua script execution

title: Known limitations

title: Feature limitations

text: - RS101204 - High memory consumption caused by the `persistence_mgr` service when AOF persistence is configured for every second. Monitor RAM usage of the process. In case of high usage, the temporary workaround is to restart the service by running `supervisorctl restart persistence_mgr`. A permanent fix is to install or upgrade to the 6.4.2 June maintenance release.

title: Upgrade limitations

text:
Before you upgrade a cluster that hosts Active-Active databases with modules to v6.4.2-30, perform the following steps:

1. Use `crdb-cli` to verify that the modules (`modules`) and their versions (in `module_list`) are as they appear in the database configuration and in the default database configuration:

    [code example]

1. From the admin console's **redis modules** tab, validate that these modules with their specific versions are loaded to the cluster.

1. If one or more of the modules/versions are missing or if you need help, [contact Redis support](https://redis.com/company/support/) before taking additional steps.

This limitation has been fixed and resolved as of [v6.4.2-43]().

title: Operating system limitations

text:
#### RHEL 7 and RHEL 8

If you have a custom installation with a non-default `$installdir` and use Active-Active or Auto Tiering features, failures might occur when you upgrade. This issue will be fixed in a future maintenance release.

#### RHEL 8

Due to module binary differences between RHEL 7 and RHEL 8, you cannot upgrade RHEL 7 clusters to RHEL 8 when they host databases using modules. Instead, you need to create a new cluster on RHEL 8 and then migrate existing data from your RHEL 7 cluster. This does not apply to clusters that do not use modules.

title: Security

text:
#### Open source Redis security fixes compatibility

As part of Redis's commitment to security, Redis Enterprise Software implements the latest [security fixes](https://github.com/redis/redis/releases) available with [open source Redis](https://github.com/redis/redis). The following open source Redis [CVEs](https://github.com/redis/redis/security/advisories) do not affect Redis Enterprise:

- [CVE-2021-32625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32625) — Redis Enterprise is not impacted by the CVE that was found and fixed in open source Redis since Redis Enterprise does not implement LCS. Additional information about the open source Redis fix is on the [Redis GitHub page](https://github.com/redis/redis/releases) (Redis 6.2.4, Redis 6.0.14)

- [CVE-2021-32672](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32672) — Redis Enterprise is not impacted by the CVE that was found and fixed in open source Redis because the LUA debugger is unsupported in Redis Enterprise. Additional information about the open source Redis fix is on the [Redis GitHub page](https://github.com/redis/redis/releases) (Redis 6.2.6, Redis 6.0.16)

- [CVE-2021-32675](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32675) — Redis Enterprise is not impacted by the CVE that was found and fixed in open source Redis because the proxy in Redis Enterprise does not forward unauthenticated requests. Additional information about the open source Redis fix is on the [Redis GitHub page](https://github.com/redis/redis/releases) (Redis 6.2.6, Redis 6.0.16)

- [CVE-2021-32762](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32762) — Redis Enterprise is not impacted by the CVE that was found and fixed in open source Redis because the memory allocator used in Redis Enterprise is not vulnerable. Additional information about the open source Redis fix is on the [Redis GitHub page](https://github.com/redis/redis/releases) (Redis 6.2.6, Redis 6.0.16)

- [CVE-2021-41099](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41099) — Redis Enterprise is not impacted by the CVE that was found and fixed in open source Redis because the `proto-max-bulk-len CONFIG` is blocked in Redis Enterprise. Additional information about the open source Redis fix is on the [Redis GitHub page](https://github.com/redis/redis/releases) (Redis 6.2.6, Redis 6.0.16)

Redis Enterprise has already included the fixes for the relevant CVEs. Some CVEs announced for open source Redis do not affect Redis Enterprise due to different and additional functionality available in Redis Enterprise that is not available in open source Redis.

section_id: deprecations

code: crdb-cli crdb get --crdb-guid <crdb-guid>

section_id: upgrade-limitations


title: Overview

text:
This is a maintenance release for [Redis Enterprise Software version 6.4.2](https://redis.io/downloads/#software).

The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-43 March release) |
|---------|---------------------------------------|
| Ubuntu 16 | bb3d3ab7590834790d2d9d9e3dcdf788 |
| Ubuntu 18 | 55e99e6db76277c15fa46c49d58995b5 |
| Ubuntu 20 | cccfa62ca7ea955b8c19d9c40bdc1fea |
| RedHat Enterprise Linux (RHEL) 7
Oracle Enterprise Linux (OL) 7 | eed4083b0b4c066d31ea9b8ba60a34f5 |
| RedHat Enterprise Linux (RHEL) 8
Oracle Enterprise Linux (OL) 8
Rocky Enterprise Linux | 7fd4321f6a5502c76197fc039f44ffa3 |

title: New features and enhancements

text:
#### Support for Ubuntu 20

Added operating system support for Ubuntu 20.04.

#### Validate client certificates by subject attributes

- Added the ability to enter multiple `Organizational Unit (OU)` values to a certificate validation's subject entry. Subject validation only succeeds if all `OU` values match.

- Validation fails if the certificate’s subject contains an extra field which is missing from the certificate’s configured subject (empty field).

#### Safe node removal (RS92095)

As of this release, the node removal task waits for persistence files to be created on a new node before finishing removal. For more information, see [Remove a cluster node]() and [`rladmin node remove`](https://docs.redis.com/latest/rs/references/cli-utilities/rladmin/node/remove/).

#### Allow port configuration for gossip_envoy service (RS72028)

You can use the REST API to configure the `gossip_envoy_admin_port` during bootstrapping or runtime. See the [cluster object reference]() for more details.

Support for `rladmin` will be added in a future 6.4.2 maintenance release.

#### Redis Stack v6.2.6

Redis Enterprise Software v6.4.2 includes the new features delivered in the latest [Redis Stack release (v6.2.6)](https://redis.com/blog/introducing-redis-stack-6-2-6-and-7-0-6/ ):

- [RediSearch v2.6.4](redisearch-2.6-release-notes/#v264-december-2022)

- [RedisJSON v2.4.5](redisjson-2.4-release-notes/#v245-february-2023)

- [RedisBloom v2.4.3](release-notes/redisbloom-2.4-release-notes/#v24-ga-v243-november-2022)

- [RedisGraph v2.10.5](redisgraph-2.10-release-notes/#v2105-december-2022)

- [RedisTimeSeries v1.8.5](redistimeseries-1.8-release-notes/#v185-january-2023)

See [Upgrade modules]() to learn how to upgrade a module for a database.

title: Resolved issues

text:
- RS95344 - Fix custom installation linkage bug for files related to Active-Active

- RS91554 - Enhance visibility of `redis_mgr`

- RS90496 - Improve cross-node communication to support failovers

- RS93004 - Allow positive `audit_port` configuration

- RS58918 - Reduce the number of clients blocked by flushing a database. Only the client that requested the flush will be blocked until the action finishes. Other clients won't be affected.

- RS85447 - When creating a database, the memory size is total memory for the database, not the total dataset size. Therefore, if you enable replication and the database has two shards, each shard will have half of the allocated memory size.

- RS90556 -  `Heartbeatd` - upgrade [`sysinfo`](https://crates.io/crates/sysinfo) dependency 0.19.1 -> 0.27.7

- RS93566 - Added [`rlcheck`]() validation step to verify that all needed modules (modules used during the initial creation of any CRDBs on the cluster) are actually available on the cluster. In some cases, if a specific module version is required, the user will need to upload it in order to upgrade the cluster. After the upgrade is complete, you can delete the required module.

title: Known limitations

title: Feature limitations

text:
#### Resharding fails for rack-aware databases with no replication

When a database is configured as [rack-aware]() and replication is turned off, the resharding operation fails.

RS97971 - This limitation will be fixed in a future 6.4.2 maintenance release.

Workaround:

Before resharding your database, turn off rack awareness:

[code example]

After the resharding process is complete, you can re-enable rack awareness:

[code example]

title: Operating system limitations

text:
#### RHEL 7 and RHEL 8

RS95344 - CRDB database will not start on Redis Enterprise v6.4.2 with a custom installation path.

For a workaround, use the following commands to add the relevant CRDB files to the Redis library:

[code example]

This limitation will be fixed in a future 6.4.2 maintenance release.

#### Ubuntu 20.04

By default, you cannot use the SHA1 hash algorithm ([OpenSSL’s default security level is set to 2](https://manpages.ubuntu.com/manpages/focal/man3/SSL_CTX_set_security_level.3ssl.html#notes)). The operating system will reject SHA1 certificates even if the `mtls_allow_weak_hashing` option is enabled. You need to replace SHA1 certificates with newer certificates that use SHA-256. Note that the certificates provided with Redis Enterprise Software use SHA-256.

#### Ubuntu 16, 18, 20

RS95824 - An error occurs when running `rl_rdbconvert` manually.

As a workaround, run the following command:

[code example]

code: LD_LIBRARY_PATH=$libdir rl_rdbconvert


title: Overview

text:
This is a maintenance release for [Redis Enterprise Software version 6.4.2](https://redis.io/downloads/#software).

The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-61 April release) |
|---------|---------------------------------------|
| Ubuntu 16 | f8f616147c9daaaeb9cd8cb1ae44157f |
| Ubuntu 18 | 1de5b0bafd4edec8d7817bddcecf3824 |
| Ubuntu 20 | 829e91c7fac1a0ab7e36cb4a65d19906 |
| RedHat Enterprise Linux (RHEL) 7
Oracle Enterprise Linux (OL) 7 | 477f1d3161ea16e8d52c41eb61d92637 |
| RedHat Enterprise Linux (RHEL) 8
Oracle Enterprise Linux (OL) 8
Rocky Enterprise Linux | 1170af43f88bf5f9095890916c0fe74d |
| Amazon Linux 2 (Release Candidate) | e246ae158db32e0a483a23392b2a7f47 |

title: New features and enhancements

text:
- Amazon Linux 2 supported as a release candidate (RC)

A database with modules cannot reside on an Amazon Linux 2 (release candidate) node. Support will be added in a future maintenance release.

- Add node ID indication to [`debug_info` package]() (RS95360)

- Add support for underscore `_` as a valid character for [rack awareness]() (RS87458)

- When updating a [BDB object](), the version property is immutable. Any validation will be performed according to the BDB object version that was set during upgrade or install (RS93294)

#### Redis Stack v6.2.6

Redis Enterprise Software v6.4.2 includes the new features delivered in the latest [Redis Stack release (6.2.6 v6)](https://redis.com/blog/introducing-redis-stack-6-2-6-and-7-0-6/):

- [RediSearch v2.6.6]()

- [RedisJSON v2.4.6]()

- [RedisBloom v2.4.5]()

- [RedisGraph v2.10.9]()

- [RedisTimeSeries v1.8.9]()

See [Upgrade modules]() to learn how to upgrade a module for a database.

title: Version changes

title: Deprecations

text:
#### Ubuntu 16.04

Ubuntu 16 support is deprecated and will be removed in a future release.

#### Active-Active database persistence

The RDB snapshot option for [Active-Active database persistence]() is deprecated and will be removed in a future release.

Please plan to reconfigure any Active-Active databases to use append-only file (AOF) persistence with the following command:

[code example]

title: Resolved issues

text:
- RS95344 - Fixed known limitation for RHEL 7 and RHEL 8 where CRDB databases fail to start when installed using custom installation paths

- RS88010 - Roll back node configuration when the [remove node]() operation fails

- RS95824 - Fixed an issue with running `rl_rdbconvert` on Ubuntu

- RS97971 - Fixed known limitation for the edge case where resharding fails for rack-aware databases with no replication

title: Known limitations

title: Operating system limitations

text:
#### Ubuntu 20.04

By default, you cannot use the SHA1 hash algorithm ([OpenSSL’s default security level is set to 2](https://manpages.ubuntu.com/manpages/focal/man3/SSL_CTX_set_security_level.3ssl.html#notes)). The operating system will reject SHA1 certificates even if the `mtls_allow_weak_hashing` option is enabled. You need to replace SHA1 certificates with newer certificates that use SHA-256. Note that the certificates provided with Redis Enterprise Software use SHA-256.

#### Modules not supported for Amazon Linux 2 release candidate

A database with modules cannot reside on an Amazon Linux 2 (release candidate) node. Support will be added in a future maintenance release.


title: Overview

text:
This is a maintenance release for [Redis Enterprise Software version 6.4.2](https://redis.io/downloads/#software).

The following table shows the MD5 checksums for the available packages:

| Package | MD5 checksum (6.4.2-69 May release) |
|---------|---------------------------------------|
| Ubuntu 16 | 31631248672de0154ec20aee0bff9adc |
| Ubuntu 18 | 7d9ebd4ea5a23137d2bb3928134ea6ef |
| Ubuntu 20 | 357ceda7467fd66962f3cb5aa143def7 |
| RedHat Enterprise Linux (RHEL) 7
Oracle Enterprise Linux (OL) 7 | 4d53fcce8c80910a05ed37ab64b57a7a |
| RedHat Enterprise Linux (RHEL) 8
Oracle Enterprise Linux (OL) 8
Rocky Enterprise Linux | 88dc6a4d96b948b086f785dc42786d03 |
| Amazon Linux 2 | 7ed06bc0b35494e4a5c084528d6e8b9f |

title: New features and enhancements

text:
- Amazon Linux 2 support

- Enhanced installation logs (RS69079, RS69571, RS77857, RS89760)

- Added support for `rladmin` envoy port configuration (RS95483)

- Support the option to avoid specific nodes when using optimized shards placement API  (RS98795)

- Check port availability before installation and upgrade (RS80815)

- Added `failure_detection_sensitivity` policy to [cluster policy REST API requests](). See the [`watchdog_profile` deprecation notice](#watchdog_profile) for more details.

#### Redis Stack v6.2.6

Redis Enterprise Software v6.4.2 includes the new features delivered in the latest [Redis Stack release (6.2.6 v6)](https://redis.com/blog/introducing-redis-stack-6-2-6-and-7-0-6/):

- [RediSearch v2.6.6]()

- [RedisJSON v2.4.7]()

- [RedisBloom v2.4.5]()

- [RedisGraph v2.10.9]()

- [RedisTimeSeries v1.8.9]()

See [Upgrade modules]() to learn how to upgrade a module for a database.

title: Version changes

title: Deprecations

text:
#### watchdog_profile

The `watchdog_profile` setting is deprecated and will be removed in a future release. Instead, use the `failure_detection_sensitivity` policy for predefined thresholds and timeouts:

[code example]

The `failure_detection_sensitivity` policy has the following options:

- `high` (previously known as `local-network watchdog_profile`) – high failure detection sensitivity, lower thresholds, and faster failure detection and failover

- `low` (previously known as `cloud watchdog_profile`) – low failure detection sensitivity and higher tolerance for latency variance (also called network jitter)

#### Ubuntu 16.04

Ubuntu 16 support is deprecated, and support will be removed in a future release.

#### Active-Active database persistence

The RDB snapshot option for [Active-Active database persistence]() is deprecated and will be removed in a future release.

Please plan to reconfigure any Active-Active databases to use append-only file (AOF) persistence with the following command:

[code example]

title: Resolved issues

text:
- RS97528 - Prevent [self-signed certificate]() script error on Ubuntu 20.04 by changing the user instructions.

- RS99643 - Fix [`cipher_suites`]() configuration to allow default cipher suites according to the control plane, data plane, and discovery service.

- RS99696 - Fix  [`HINCRBYFLOT`](https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6) CVE

- RS54226 - During upgrades, a CRDB worker process would intermittently get stuck in a restart loop. This issue is now fixed.

title: Known limitations

title: Feature limitations

text: - RS78430 -  When [tuning module arguments](), any typo or use of unsupported arguments can cause shards to get stuck after restart.

title: Operating system limitations

text:
#### Ubuntu 20.04

By default, you cannot use the SHA1 hash algorithm ([OpenSSL’s default security level is set to 2](https://manpages.ubuntu.com/manpages/focal/man3/SSL_CTX_set_security_level.3ssl.html#notes)). The operating system will reject SHA1 certificates even if the `mtls_allow_weak_hashing` option is enabled. You need to replace SHA1 certificates with newer certificates that use SHA-256. Note that the certificates provided with Redis Enterprise Software use SHA-256.

code: rladmin tune cluster failure_detection_sensitivity [ high | low ]