Redis Software release notes 8.2.6-25 (October 2026)

Redis database version 8.8. Redis Search on Flex in preview. Customer-provided encryption keys (SSE-C) for exports and imports.

Redis Software

​​Redis Software version 8.2.6 is now available.

Highlights

This version offers:

  • Redis database version 8.8

  • Redis Search on Flex databases, in preview

  • Customer-provided encryption keys (SSE-C) for exports and imports with Amazon S3 and S3-compatible storage

  • Internal fixes and improvements

New in this release

New features

Redis database version 8.8

Redis Software 8.2.6 adds Redis database version 8.8. See What's new in Redis 8.8 and the Redis Open Source 8.8 release notes.

Redis Search on Flex (preview)

Flex databases can now store Redis Search indexes on flash, so large indexes don't need to fit in RAM. Redis Search on Flex requires Redis database version 8.8 or later.

See Index and search data in Flex databases for requirements, supported features, and limitations.

Customer-provided encryption keys for exports and imports

You can now encrypt data you export to Amazon S3 or S3-compatible storage with a customer-provided encryption key (SSE-C), and import data from a source encrypted with one. You provide the key in each export or import request.

See Export data from a database and Import data into a database.

Enhancements

  • Cluster FQDN in support package file names. Add the fqdn option to rladmin cluster debug_info to include the cluster's fully qualified domain name (FQDN) in the support package file name, which helps you tell support packages from different clusters apart.

  • Selective fork termination under memory pressure. When a node runs low on memory for fork operations, such as backups, AOF rewrites, and replica full syncs, Redis Software now stops only the most recently started forks needed to free enough memory, instead of stopping all of them. The older forks can finish and release their memory, which prevents repeated cycles of failed full syncs and backups.

  • Key size metrics for Active-Active databases on Redis 7.4. v2 metrics that count keys by value size or number of elements, such as strings larger than 512 MB or sets, sorted sets, hashes, and lists with more than 8 million elements, are now available for Active-Active databases that use Redis database version 7.4.

Redis database versions and feature sets

Redis Software version 8.2.6 includes the following Redis database versions: 8.8.0, 8.6.2, 8.4.0, 8.2.1, 8.0.2, 7.4.3, 7.2.7, and 6.2.13.

The default Redis database version is 8.6.

Redis Software includes multiple feature sets, compatible with different Redis database versions.

Show feature set details

The following table shows which Redis modules are compatible with each Redis database version included in this release.

Redis database version Compatible Redis modules
8.8 RediSearch 8.8
RedisJSON 8.8
RedisTimeSeries 8.8
RedisBloom 8.8
See What's new in Redis 8.8 and Redis Open Source 8.8 release notes
8.6 RediSearch 8.6
RedisJSON 8.6
RedisTimeSeries 8.6
RedisBloom 8.6
See What's new in Redis 8.6 and Redis Open Source 8.6 release notes
8.4 RediSearch 8.4
RedisJSON 8.4
RedisTimeSeries 8.4
RedisBloom 8.4
See What's new in Redis 8.4 and Redis Open Source 8.4 release notes
8.2 RediSearch 8.2
RedisJSON 8.2
RedisTimeSeries 8.2
RedisBloom 8.2
See What's new in Redis 8.2 and Redis Open Source 8.2 release notes
8.0 RediSearch 8.0
RedisJSON 8.0
RedisTimeSeries 8.0
RedisBloom 8.0
See What's new in Redis 8.0 and Redis Open Source 8.0 release notes
7.4 RediSearch 2.10
RedisJSON 2.8
RedisTimeSeries 1.12
RedisBloom 2.8
7.2 RediSearch 2.8
RedisJSON 2.6
RedisTimeSeries 1.10
RedisBloom 2.6
6.2 RediSearch 2.6
RedisJSON 2.4
RedisTimeSeries 1.8
RedisBloom 2.4

Resolved issues

  • RS147347: Fixed an issue where a failover could get stuck when a long-running Lua script made the newly promoted primary shard unresponsive.

  • RS152117: Fixed an issue where disabling connection auditing with db_conns_auditing did not stop the DMC proxy from connecting to the auditing server.

  • RS163957: Fixed an issue where a failover could get stuck if the node with the primary shards went down while the cluster was moving primary shards off that node, for example during rladmin node <ID> enslave or rladmin node <ID> maintenance_mode on.

  • RS176407: Fixed an issue where the discovery service did not retry loading the database list after node restarts, which caused client connection errors.

  • RS182474: Fixed an issue where old AOF .prev folders were not deleted when the persistent storage path was changed from the default during node setup, which could fill the persistent storage disk.

  • RS182713: Fixed an issue where crdb-cli crdb create did not fully validate shard_key_regex in --default-db-config. An invalid value could leave Active-Active database creation stuck and prevent you from deleting the database.

  • RS182889: Fixed an issue where rlcheck reported success even when a service was in the BACKOFF state.

  • RS186010: Fixed an issue where replica full syncs could fail repeatedly when several ran at the same time on a node with low free memory, which could leave failovers and node removal stuck.

  • RS193680: Fixed an issue where, with the all-nodes endpoint policy, DNS continued to return the IP address of a node that was down for several minutes.

  • RS196638: Fixed an issue where updating an Active-Active database to set an instance's db_config field to null, to fall back to default_db_config, failed validation for some fields, such as data_persistence, tls_mode, proxy_policy, and eviction_policy.

  • RS196965: Fixed an issue where an Active-Active database went out of sync with an encryption error when authentication_ssl_client_certs included CA certificates.

  • RS197093: Fixed an issue where planning shard placement to scale out a database could fail with Cannot allocate nodes for slave shards, count bomb at -1 even when a valid placement existed.

  • RS197570: Fixed an issue where users with the User Manager role could not edit other users' email addresses, passwords, or ACLs in the Cluster Manager UI.

  • RS197670: Fixed an issue where several Active-Active databases stopped syncing and syncer logs filled up when one node hosted many Active-Active database endpoints.

  • RS197961: Fixed an issue where a database's shards could use more combined memory than the database memory limit when the database grew very quickly.

  • RS197962: Fixed an issue where upgrading deleted customer-created roles, which caused single sign-on (SSO) just-in-time provisioning to fail.

  • RS198022: Fixed an issue where rladmin node <ID> external_addr set accepted duplicate addresses, which created duplicate DNS records.

  • RS198370: Fixed an issue where replication for Redis Flex databases restarted from the beginning when the max_slave_full_syncs limit took effect after the checkpoint phase.

  • RS198633: Fixed an issue where a failover could proceed during a cluster master election while the cluster master was isolated from the network, which could leave two primary shards and break replication.

  • RS198733: Fixed an issue where the cluster could place shards on a node configured as quorum only.

  • RS198984: Fixed an issue where LDAP users could not sign in to the Cluster Manager UI.

  • RS199023: Fixed an issue where the Cluster Manager UI and the database health report REST API reported Active-Active replication as down when participating clusters ran different Redis Software versions.

  • RS199700: Fixed an issue where a database that was not an Active-Active database but had crdt_sync enabled could not be upgraded to Redis database version 8.0 or later.

  • RS199707: Fixed an issue where automatic AOF rewrites could stop on a node while the cluster kept running, which let AOF files and persistent disk usage keep growing.

  • RS199842: Fixed an issue where ACL updates failed on some shards with the error Could not parse None as a boolean.

  • RS200250: Changed the permissions of the diagnostic logging directory, /var/opt/redislabs/log/diagnostics, to 640.

  • RS201408: Fixed an issue where the firewalld service definitions did not include all documented ports, so those ports stayed blocked after a default installation on RHEL.

  • RS201488: Fixed an issue where rladmin tune db <db> slave_buffer <value> and the equivalent REST API request failed, and left only some shards updated, when a shard was unreachable. The new value is now stored and applied to each shard as it becomes reachable.

  • RS202179: Fixed an issue where Redis Software services could restart repeatedly on a slow node because startup took longer than the operating system's default service startup timeout.

  • RS202472: Fixed an issue where upgrades failed with the error Background processes currently running even when no tasks were running.

  • RS202473: Fixed an issue where upgrade_mode stayed enabled after you upgraded the last node in the cluster.

  • RS205562: Fixed an issue where a replica shard of a database with Redis Search indexes could restart repeatedly while loading data during a full sync.

  • RS206359: Fixed an issue where increasing the memory limit of an Active-Active database did not clear its out-of-memory state.

  • RS207736: Fixed an issue where a timeout while committing an Active-Active database configuration change to one participating cluster could leave the participating clusters on different configuration versions and stop synchronization.

  • RS207864: Fixed an issue where the discovery service's memory usage grew continuously when clients rapidly opened and closed TLS connections.

  • RS207995: Fixed an issue where FT.SEARCH and FT.INFO kept failing with shards topology update is either transient or has failed after node changes during an upgrade, even after the cluster was stable.

  • RS208093: Fixed an issue where a database update that used a shards blueprint to change the number of shards could fail with Cannot match group_ids for shards_blueprint.

  • RS208861: Fixed an issue where HELLO 3 reported mode cluster when the OSS Cluster API was disabled.

  • RS209365: Fixed an issue where a Replica Of full sync could fail repeatedly on a shard that contained a very large key.

  • RS209426: Fixed an issue where the discovery service exited and restarted repeatedly after a node was removed from the cluster.

  • RS209544: Fixed an issue where an Active-Active syncer did not restart after a connection error, which left synchronization stopped.

  • RS209754: Fixed an issue where crdb-cli crdb remove-instance could hang with 504 errors and make Active-Active database management unavailable.

  • RS209935: Fixed an issue where repeated failovers during a network disruption could cause data loss on an Active-Active database with a single participating cluster.

  • RS210056: Fixed an issue where the DMC proxy crashed repeatedly while resharding a database with more than 200 primary shards under pipelined client traffic, which dropped client connections.

  • RS210070: Fixed an issue where cluster setup could fail on RHEL 9 when the system OpenSSL default digest was set to SHA-1.

  • RS210376: Fixed an issue where the DMC proxy could stop receiving configuration changes after its connection to the cluster master stalled, which caused database and endpoint operations to fail with verification timed out errors.

  • RS210428: Fixed an issue where an Active-Active syncer kept trying to connect to a removed node after node replacement, which stalled synchronization.

  • RS210779: Fixed an issue where certificate-based authentication failed when the client certificate subject included extra attributes, such as emailAddress.

  • RS210787: Fixed an issue where adding a participating cluster to an Active-Active database failed after shards_count was increased on a database without sharding.

  • RS210791: Fixed an issue where a large cluster could become unresponsive after a cluster master change, when many nodes reconnected to the new cluster master at the same time.

  • RS210977: Fixed an issue where an upgrade could report a completed step as timed out and leave the cluster partly reconfigured, so the cluster could later stop responding after a node failed or was replaced.

  • RS211018: Fixed an issue where resharding a database with sparse shard placement could place most primary shards on one node.

  • RS211657: Fixed an issue where the Cluster Manager UI Overview page did not load after an upgrade from Redis Software 7.2.4 to 8.2.0 because the GET /v2/actions REST API request returned an error.

  • RS212502: Fixed an issue where the discovery service went down on all nodes after you enabled TLS for a database.

  • RS212623: Fixed an issue where a failed database operation could leave stale data that caused a later failover of the same database to fail, which left the database unavailable.

  • RS212738: Fixed an issue where the DMC proxy could crash while processing a SCAN command during a rolling upgrade with Smart client handoffs (SCH) enabled.

  • RS212887: Fixed an issue where very large multi-key UNLINK requests received no reply, and request metrics did not match traffic.

  • RS213534: Fixed an issue where rladmin cluster recover failed when internode encryption used customer-provided certificates.

  • RS213830: Fixed an issue where creating a database from persistence files with POST /v2/bdbs and a recovery_plan retried indefinitely when no persistence files were found, instead of failing with a missing_recovery_files error.

  • RS213865: Fixed an issue where an ACL rule such as -config|get did not block CONFIG GET.

  • RS214201: Fixed an issue where replica shards failed to sync after a node reboot, which left databases without replication.

  • RS214244: Fixed an issue where database recovery failed when the append-only file (AOF) was empty.

  • RS217882: Fixed an issue where resharding and other database operations could fail with verification timed out: 1 notifications still pending when the DMC proxy was slow to apply configuration changes on nodes with high CPU usage.

  • RS218864: Fixed an issue where log files for Auto Tiering databases that use the Speedb storage engine used much more disk space than their file size showed after log rotation, which could fill the log disk on busy nodes.

  • RS220480: Fixed an issue where upgrading a cluster from Redis Software versions 7.0 through 7.4 could lose the cluster configuration, including DNS records, if the cluster master changed while some nodes still ran the earlier version.

Version changes

JWT token invalidation on upgrade

To improve system security, the JWT signing secret has changed in version 8.0.22 and later. As a result, upgrading invalidates all previously issued JWT tokens, which must be regenerated. Tokens used programmatically within the cluster are regenerated automatically. Cluster Manager users must sign out and sign in again, or wait for their session or token to expire.

Reserved ports

Make sure the following ports are open before upgrading Redis Software.

The following port was added as a reserved port in Redis Software version 8.0.18; however, it is optional instead of reserved in Redis Software version 8.0.20-44:

Port Process name Usage
3357 reconciliation_tree_grpc Internal communication

Ports reserved as of Redis Software version 7.22.0:

Port Process name Usage
3346 cluster_api_internal Cluster API internal port
3351 cluster_watchdog_grpc_api Cluster watchdog now supports gRPC
3352 grpc_service_mesh gRPC communication between nodes
3353 local_grpc_service_mesh Local gRPC services
3354 grpc_gossip_envoy gRPC gossip protocol communication between nodes
3355 authentication_service Authentication service internal port

Ports reserved as of Redis Software version 7.8.2:

Port Process name Usage
3347 cert_exporter Reports cluster certificate metrics
3348 process_exporter Reports process metrics for DMC and Redis processes
3349 cluster_wd_exporter Reports cluster watchdog metrics
3350 db_controller Internode communication
9091 node_exporter Reports host node metrics related to CPU, memory, disk, and more
9125 statsd_exporter Reports push metrics related to the DMC and syncer, and some cluster and node metrics

See Ports and port ranges used by Redis Software for a complete list.

Deprecations

  • The max_redis_forks cluster and node setting is deprecated and no longer limits concurrent redis-server fork operations on a node, such as BGSAVE, AOF rewrite, full sync, and backup or export. The setting could previously cause database backups to fail indefinitely.

    Existing automation that sets max_redis_forks with rladmin tune or the REST API keeps running without errors, but the setting has no effect. To limit full-sync concurrency, use max_slave_full_syncs instead.

Supported platforms

The following table provides a snapshot of supported platforms as of this Redis Software release. See the supported platforms reference for more details about operating system compatibility.

Amazon Linux 2 is no longer supported. Starting with Redis Software version 8.0.22, Redis Software no longer builds or publishes Amazon Linux 2 (amzn2) packages. Use Amazon Linux 2023 instead.

Show supported platforms

✅ Supported – The platform is supported for this version of Redis Software and Redis Stack modules.

⚠️ Deprecation warning – The platform is still supported for this version of Redis Software, but support will be removed in a future release.

Redis Software
major versions		 8.2 8.0 7.22 7.8 7.4 7.2 6.4 6.2
Release date Jul 2026 Oct 2025 May 2025 Nov 2024 Feb 2024 Aug 2023 Feb 2023 Aug 2021
End-of-life date Determined after
next major release		 Jul 2028 Oct 2027 May 2027 Nov 2026 Feb 2026 Aug 2025 Feb 2025
Platforms
RHEL 9 &
compatible distros1		 ✅ ✅ ✅ ✅ ✅ – – –
RHEL 9
FIPS mode5		 ✅ ✅ ✅ ✅ – – – –
RHEL 8 &
compatible distros1		 ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
RHEL 7 &
compatible distros1		 – – – – – ⚠️ ⚠️ ⚠️
Ubuntu 22.042 ✅ ✅ ✅ ✅ – – – –
Ubuntu 20.042 ✅ ✅ ✅ ✅ ✅ ✅ ✅ –
Ubuntu 18.042 – – – – ⚠️ ⚠️ ⚠️ ⚠️
Ubuntu 16.042 – – – – – ⚠️ ⚠️ ⚠️
Amazon Linux 20236 ✅ ✅ – – – – – –
Amazon Linux 2 – ✅ ✅ ✅ ✅ ✅ ✅ –
Amazon Linux 1 – – – – – ⚠️ ⚠️ ⚠️
Kubernetes3 ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
Docker4 ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

  1. The RHEL-compatible distributions CentOS, CentOS Stream, Alma, and Rocky are supported if they have full RHEL compatibility. Oracle Linux running the Red Hat Compatible Kernel (RHCK) is supported, but the Unbreakable Enterprise Kernel (UEK) is not supported.

  2. The server version of Ubuntu is recommended for production installations. The desktop version is only recommended for development deployments.

  3. See the Redis Enterprise for Kubernetes documentation for details about support per version and Kubernetes distribution.

  4. Docker images of Redis Software are certified for development and testing only.

  5. Supported only if FIPS was enabled during RHEL installation to ensure FIPS compliance.

  6. Amazon Linux 2023 support was added in Redis Software version 8.0.20.

Downloads

The following table shows the SHA256 checksums for the available packages:

Package SHA256 checksum (8.2.6-25 October release)
Ubuntu 20 28ace57b01bac0de4f3847ba29e4e0710c0e1b6d9464254b398ad76738b80734
Ubuntu 22 (amd64) 27dad5afff38d98da3db869023394ba74f746a127eaf20cf50910949a4903118
Ubuntu 22 (arm64) 7be4617206cb2ad9865c833ab88b48f31c5bf6097aac5c9888a52508ea96ed27
Red Hat Enterprise Linux (RHEL) 8 bdbd7eafd22e58b83027ac97ecf3ae4fcdea99eeeaa762af2da3fbdc39226735
Red Hat Enterprise Linux (RHEL) 9 (amd64) 51bc922cda44c389b02202e40d099a893ac506e5fa4686f3544ebdb3b56d1428
Red Hat Enterprise Linux (RHEL) 9 (arm64) d13f2441510be19721737ec4676a0e6eff7584edc7b2f6824c1c9c96cef31f07
Red Hat Enterprise Linux (RHEL) 9 FIPS (amd64) eea84da171493780dfb4286e80053b3ed41114d998954c879331d4d918a097e0
Amazon Linux 2023 (amd64) abf699f8f57a52cf37ce4acd7b14dee58f724c364dddaa08e841a3f9b08d6d21
Amazon Linux 2023 (arm64) 9119619374adf2921074766c9d0807c166c2125e3d9285fa09b7184b3851ceba

Known issues

  • RS155734: Endpoint availability metrics do not work as expected due to a calculation error.

Known limitations

Active-Active database updates rejected after upgrading to 8.2.6

On clusters running versions earlier than 8.2.6, a cluster master failover (for example, during a Kubernetes operator upgrade) can interrupt a change to an Active-Active database while the change is in progress. After the upgrade to 8.2.6, updates to that database can still be rejected with 409 – Another operation is already in progress. This only happens if the configuration change started within seconds of the failover.

Workaround: Before you upgrade, wait until all pending Active-Active database changes have finished.

TimeSeries and Search command failures during online module upgrades

During an online module upgrade, Redis Software can temporarily reject TimeSeries and Search commands across the database, including commands for healthy shards. Rejected commands return the error ERR could not perform command '<command>' because shards topology update is either transient or has failed. Rejected writes are not applied and are not retried automatically. Commands succeed again after the topology update reaches all primary shards.

Schedule module upgrades during a maintenance window. Make sure applications handle this error, retry eligible operations, and do not treat a rejected write as successful.

Increased memory usage in FIPS mode

FIPS-enabled builds use more memory than non-FIPS builds. Each Go-based control-plane service uses roughly 34 MB more when running in FIPS mode, which adds up to approximately 210 MB of additional memory per node. Account for this overhead when sizing FIPS-enabled deployments. This limitation affects FIPS-enabled builds only.

SFTP storage not supported in FIPS mode

FIPS-enabled builds do not support SFTP as a storage location for backups, imports, or exports, because the SFTP library is not FIPS-compliant. In FIPS mode, use a different storage location. This limitation affects FIPS-enabled builds only.

Redis Search query failures during rolling upgrades across the 8.4 version boundary

Redis Search queries can fail during a rolling upgrade when a cluster contains shards running Redis versions earlier than 8.4 and shards running Redis version 8.4 or later, due to an internal protocol change introduced in version 8.4. This issue affects only clusters where parallel_shards_upgrade has been changed from its default value of 0. If both conditions apply, expect Redis Search downtime until all nodes are upgraded.

Trim ACKED not supported for Active-Active 8.4 databases

For Active-Active databases running Redis database version 8.4, the ACKED option is not supported for trimming commands.

Rolling upgrade limitation for clusters with custom or deprecated modules

Due to module handling changes introduced in Redis Software version 8.0, upgrading a cluster that contains custom or deprecated modules, such as RedisGraph and RedisGears v2, can become stuck when adding a new node to the cluster during a rolling upgrade.

Cluster Manager sign-outs and false "down" status during an Active-Active upgrade

While an Active-Active database has participating clusters running different Redis Software versions, the Cluster Manager UI on an upgraded cluster can sign users out intermittently and show a participating cluster as down, even though replication is active and the syncers are connected.

This affects the Cluster Manager UI only. It's caused by a JWT signing-key mismatch between nodes running different versions during the upgrade window (see JWT token invalidation on upgrade). The data path and replication are not affected.

To resolve it, upgrade the remaining participating clusters. The issue clears after every participating cluster runs the same version. If you're signed out, sign in again.

Module commands limitation during Active-Active database upgrades to Redis 8.0

When upgrading an Active-Active database to Redis version 8.0, you cannot use module commands until all Active-Active database instances have been upgraded. Currently, these commands are not blocked automatically.

Redis 8.0 database cannot be created with flash

You cannot create a Redis 8.0 database with flash storage enabled. Create a Redis 8.0 database with RAM-only storage instead, or use Redis 8.2 for flash-enabled (Redis Flex) databases.

Cluster Manager UI limitations

The following legacy UI features are not yet available in the new Cluster Manager UI:

Security

Redis Open Source security fixes compatibility

As part of Redis's commitment to security, Redis Software implements the latest security fixes available with Redis Open Source. Redis Software has already included the fixes for the relevant CVEs.

Some CVEs announced for Redis Open Source do not affect Redis Software due to different or additional functionality available in Redis Software that is not available in Redis Open Source.

Redis Software 8.2.6 supports Redis Open Source 8.8, 8.6, 8.4, 8.2, 8.0, 7.4, 7.2, and 6.2. Below is the list of Redis Open Source CVEs and other security vulnerabilities fixed by version.

Redis 8.8.x

  • Memory corruption in SLOT_INFO handling may allow an unauthenticated user to potentially run their own code.

  • A use-after-free in TLS pending-data processing may allow an authenticated user to cause a denial-of-service.

  • A vulnerability in the RESTORE command and in RDB loading allows an authenticated user to trigger a use-after-free in stream consumer groups via a specially crafted serialized payload, potentially resulting in remote code execution.

  • An ACL key-pattern bypass in GEORADIUS and GEORADIUSBYMEMBER may allow an authenticated user to write to keys outside their permitted key patterns.

  • An out-of-bounds read during command key extraction may cause the server to crash.

  • VSET: Missing level cap when loading a serialized HNSW graph may lead to resource exhaustion.

  • VSET: Missing validation of the parameter count when loading a serialized vector set may lead to oversized allocation and resource exhaustion.

  • Certificate common-name handling can allow an authentication bypass when tls-auth-clients-user is set to CN.

  • (CVE-2026-62356) An authenticated user may trigger a heap out-of-bounds write in RedisBloom by loading a specially crafted Count-Min Sketch (CMSketch) object, for example via the RESTORE command or a crafted RDB file.

  • RedisBloom: Out-of-bounds access in the TopK heap cleanup path.

  • VSET: Large VADD REDUCE values can lead to out-of-memory crashes or buffer overflow.

  • (CVE-2026-23479) When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.

  • (CVE‑2026‑25243) A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-25588) A vulnerability in the RESTORE command, when used with the RedisTimeSeries module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE‑2026‑25589) A vulnerability in the RESTORE command, when used with the RedisBloom module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-23631) An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.

  • Insufficient sanitization of Lua script error messages can allow an authenticated user with EVAL permission to inject arbitrary RESP protocol responses, leading to denial of service, data manipulation, and connection pool poisoning.

  • RedisBloom: Integer overflow in TopK RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in td_histogram_t RDB loading may lead to heap buffer overflow.

  • RedisBloom: Missing validation in CuckooFilter RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in SBChain and CMSketch RDB loading may lead to heap out-of-bounds write.

  • Added validation of limits during RDB load and data creation to avoid resource exhaustion and Denial-of-Service (DoS) vulnerabilities.

Redis 8.6.x

  • Memory corruption in SLOT_INFO handling may allow an unauthenticated user to potentially run their own code.

  • A use-after-free in TLS pending-data processing may allow an authenticated user to cause a denial-of-service.

  • A vulnerability in the RESTORE command and in RDB loading allows an authenticated user to trigger a use-after-free in stream consumer groups via a specially crafted serialized payload, potentially resulting in remote code execution.

  • An ACL key-pattern bypass in GEORADIUS and GEORADIUSBYMEMBER may allow an authenticated user to write to keys outside their permitted key patterns.

  • An out-of-bounds read during command key extraction may cause the server to crash.

  • VSET: Missing level cap when loading a serialized HNSW graph may lead to resource exhaustion.

  • VSET: Missing validation of the parameter count when loading a serialized vector set may lead to oversized allocation and resource exhaustion.

  • Certificate common-name handling can allow an authentication bypass when tls-auth-clients-user is set to CN.

  • (CVE-2026-62356) An authenticated user may trigger a heap out-of-bounds write in RedisBloom by loading a specially crafted Count-Min Sketch (CMSketch) object, for example via the RESTORE command or a crafted RDB file.

  • RedisBloom: Out-of-bounds access in the TopK heap cleanup path.

  • VSET: Large VADD REDUCE values can lead to out-of-memory crashes or buffer overflow.

  • (CVE-2026-23479) When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.

  • (CVE‑2026‑25243) A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-25588) A vulnerability in the RESTORE command, when used with the RedisTimeSeries module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE‑2026‑25589) A vulnerability in the RESTORE command, when used with the RedisBloom module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-23631) An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.

  • Insufficient sanitization of Lua script error messages can allow an authenticated user with EVAL permission to inject arbitrary RESP protocol responses, leading to denial of service, data manipulation, and connection pool poisoning.

  • RedisBloom: Integer overflow in TopK RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in td_histogram_t RDB loading may lead to heap buffer overflow.

  • RedisBloom: Missing validation in CuckooFilter RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in SBChain and CMSketch RDB loading may lead to heap out-of-bounds write.

  • Added validation of limits during RDB load and data creation to avoid resource exhaustion and Denial-of-Service (DoS) vulnerabilities.

Redis 8.4.x

  • Memory corruption in SLOT_INFO handling may allow an unauthenticated user to potentially run their own code.

  • A use-after-free in TLS pending-data processing may allow an authenticated user to cause a denial-of-service.

  • A vulnerability in the RESTORE command and in RDB loading allows an authenticated user to trigger a use-after-free in stream consumer groups via a specially crafted serialized payload, potentially resulting in remote code execution.

  • An ACL key-pattern bypass in GEORADIUS and GEORADIUSBYMEMBER may allow an authenticated user to write to keys outside their permitted key patterns.

  • An out-of-bounds read during command key extraction may cause the server to crash.

  • VSET: Missing level cap when loading a serialized HNSW graph may lead to resource exhaustion.

  • VSET: Missing validation of the parameter count when loading a serialized vector set may lead to oversized allocation and resource exhaustion.

  • (CVE-2026-62356) An authenticated user may trigger a heap out-of-bounds write in RedisBloom by loading a specially crafted Count-Min Sketch (CMSketch) object, for example via the RESTORE command or a crafted RDB file.

  • RedisBloom: Out-of-bounds access in the TopK heap cleanup path.

  • VSET: Large VADD REDUCE values can lead to out-of-memory crashes or buffer overflow.

  • (CVE-2026-23479) When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.

  • (CVE‑2026‑25243) A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-25588) A vulnerability in the RESTORE command, when used with the RedisTimeSeries module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE‑2026‑25589) A vulnerability in the RESTORE command, when used with the RedisBloom module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-23631) An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.

  • Insufficient sanitization of Lua script error messages can allow an authenticated user with EVAL permission to inject arbitrary RESP protocol responses, leading to denial of service, data manipulation, and connection pool poisoning.

  • RedisBloom: Integer overflow in TopK RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in td_histogram_t RDB loading may lead to heap buffer overflow.

  • RedisBloom: Missing validation in CuckooFilter RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in SBChain and CMSketch RDB loading may lead to heap out-of-bounds write.

  • Added validation of limits during RDB load and data creation to avoid resource exhaustion and Denial-of-Service (DoS) vulnerabilities.

Redis 8.2.x

  • Memory corruption in SLOT_INFO handling may allow an unauthenticated user to potentially run their own code.

  • A use-after-free in TLS pending-data processing may allow an authenticated user to cause a denial-of-service.

  • A vulnerability in the RESTORE command and in RDB loading allows an authenticated user to trigger a use-after-free in stream consumer groups via a specially crafted serialized payload, potentially resulting in remote code execution.

  • An ACL key-pattern bypass in GEORADIUS and GEORADIUSBYMEMBER may allow an authenticated user to write to keys outside their permitted key patterns.

  • An out-of-bounds read during command key extraction may cause the server to crash.

  • VSET: Missing level cap when loading a serialized HNSW graph may lead to resource exhaustion.

  • VSET: Missing validation of the parameter count when loading a serialized vector set may lead to oversized allocation and resource exhaustion.

  • (CVE-2026-62356) An authenticated user may trigger a heap out-of-bounds write in RedisBloom by loading a specially crafted Count-Min Sketch (CMSketch) object, for example via the RESTORE command or a crafted RDB file.

  • RedisBloom: Out-of-bounds access in the TopK heap cleanup path.

  • VSET: Large VADD REDUCE values can lead to out-of-memory crashes or buffer overflow.

  • (CVE-2026-23479) When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.

  • (CVE‑2026‑25243) A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-25588) A vulnerability in the RESTORE command, when used with the RedisTimeSeries module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE‑2026‑25589) A vulnerability in the RESTORE command, when used with the RedisBloom module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-23631) An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.

  • Insufficient sanitization of Lua script error messages can allow an authenticated user with EVAL permission to inject arbitrary RESP protocol responses, leading to denial of service, data manipulation, and connection pool poisoning.

  • RedisBloom: Integer overflow in TopK RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in td_histogram_t RDB loading may lead to heap buffer overflow.

  • RedisBloom: Missing validation in CuckooFilter RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in SBChain and CMSketch RDB loading may lead to heap out-of-bounds write.

  • Added validation of limits during RDB load and data creation to avoid resource exhaustion and Denial-of-Service (DoS) vulnerabilities.

  • RedisBloom: Restore invalid filter.

  • (CVE-2025-62507) A user can run the XACKDEL command with multiple IDs and trigger a stack buffer overflow, which can potentially lead to remote code execution.

  • The HGETEX command can lead to a buffer overflow.

  • Integer overflow in hllPatLen.

  • RedisBloom: Cuckoo filter counter overflow.

  • RedisBloom: Invalid Bloom filters can cause arbitrary memory reads and writes.

  • RedisBloom: Reachable assert in TopK_Create

  • RedisBloom: Out-of-bounds access with empty Bloom chains.

  • RedisBloom: Division by zero in Cuckoo filter insertion.

  • (CVE-2025-46818) An authenticated user may use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user.

  • (CVE-2025-46819) An authenticated user may use a specially crafted LUA script to read out-of-bound data or crash the server and lead to subsequent denial of service.

  • (CVE-2025-46817) An authenticated user may use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution.

  • (CVE-2025-49844) An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution.

Redis 8.0.x

  • Memory corruption in SLOT_INFO handling may allow an unauthenticated user to potentially run their own code.

  • A use-after-free in TLS pending-data processing may allow an authenticated user to cause a denial-of-service.

  • A vulnerability in the RESTORE command and in RDB loading allows an authenticated user to trigger a use-after-free in stream consumer groups via a specially crafted serialized payload, potentially resulting in remote code execution.

  • An ACL key-pattern bypass in GEORADIUS and GEORADIUSBYMEMBER may allow an authenticated user to write to keys outside their permitted key patterns.

  • An out-of-bounds read during command key extraction may cause the server to crash.

  • (CVE-2026-62356) An authenticated user may trigger a heap out-of-bounds write in RedisBloom by loading a specially crafted Count-Min Sketch (CMSketch) object, for example via the RESTORE command or a crafted RDB file.

  • RedisBloom: Out-of-bounds access in the TopK heap cleanup path.

  • VSET: Large VADD REDUCE values can lead to out-of-memory crashes or buffer overflow.

  • (CVE-2026-23479) When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.

  • (CVE‑2026‑25243) A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-25588) A vulnerability in the RESTORE command, when used with the RedisTimeSeries module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE‑2026‑25589) A vulnerability in the RESTORE command, when used with the RedisBloom module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-23631) An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.

  • Insufficient sanitization of Lua script error messages can allow an authenticated user with EVAL permission to inject arbitrary RESP protocol responses, leading to denial of service, data manipulation, and connection pool poisoning.

  • RedisBloom: Integer overflow in TopK RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in td_histogram_t RDB loading may lead to heap buffer overflow.

  • RedisBloom: Missing validation in CuckooFilter RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in SBChain and CMSketch RDB loading may lead to heap out-of-bounds write.

  • Added validation of limits during RDB load and data creation to avoid resource exhaustion and Denial-of-Service (DoS) vulnerabilities.

  • RedisBloom: Restore invalid filter.

  • The HGETEX command can lead to a buffer overflow.

  • Integer overflow in hllPatLen.

  • RedisBloom: Cuckoo filter counter overflow.

  • RedisBloom: Invalid Bloom filters can cause arbitrary memory reads and writes.

  • RedisBloom: Reachable assert in TopK_Create

  • RedisBloom: Out-of-bounds access with empty Bloom chains.

  • RedisBloom: Division by zero in Cuckoo filter insertion.

  • (CVE-2025-46818) An authenticated user may use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user.

  • (CVE-2025-46819) An authenticated user may use a specially crafted LUA script to read out-of-bound data or crash the server and lead to subsequent denial of service.

  • (CVE-2025-46817) An authenticated user may use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution.

  • (CVE-2025-49844) An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution.

Redis 7.4.x

  • Memory corruption in SLOT_INFO handling may allow an unauthenticated user to potentially run their own code.

  • A use-after-free in TLS pending-data processing may allow an authenticated user to cause a denial-of-service.

  • A vulnerability in the RESTORE command and in RDB loading allows an authenticated user to trigger a use-after-free in stream consumer groups via a specially crafted serialized payload, potentially resulting in remote code execution.

  • An ACL key-pattern bypass in GEORADIUS and GEORADIUSBYMEMBER may allow an authenticated user to write to keys outside their permitted key patterns.

  • An out-of-bounds read during command key extraction may cause the server to crash.

  • (CVE-2026-62356) An authenticated user may trigger a heap out-of-bounds write in RedisBloom by loading a specially crafted Count-Min Sketch (CMSketch) object, for example via the RESTORE command or a crafted RDB file.

  • RedisBloom: Out-of-bounds access in the TopK heap cleanup path.

  • (CVE-2026-23479) When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.

  • (CVE‑2026‑25243) A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-25588) A vulnerability in the RESTORE command, when used with the RedisTimeSeries module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE‑2026‑25589) A vulnerability in the RESTORE command, when used with the RedisBloom module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-23631) An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.

  • Insufficient sanitization of Lua script error messages can allow an authenticated user with EVAL permission to inject arbitrary RESP protocol responses, leading to denial of service, data manipulation, and connection pool poisoning.

  • RedisBloom: Integer overflow in TopK RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in td_histogram_t RDB loading may lead to heap buffer overflow.

  • RedisBloom: Missing validation in CuckooFilter RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in SBChain and CMSketch RDB loading may lead to heap out-of-bounds write.

  • Added validation of limits during RDB load and data creation to avoid resource exhaustion and Denial-of-Service (DoS) vulnerabilities.

  • RedisBloom: Restore invalid filter.

  • Integer overflow in hllPatLen.

  • RedisBloom: Cuckoo filter counter overflow.

  • RedisBloom: Invalid Bloom filters can cause arbitrary memory reads and writes.

  • RedisBloom: Reachable assert in TopK_Create

  • RedisBloom: Out-of-bounds access with empty Bloom chains.

  • RedisBloom: Division by zero in Cuckoo filter insertion.

  • (CVE-2025-46818) An authenticated user may use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user.

  • (CVE-2025-46819) An authenticated user may use a specially crafted LUA script to read out-of-bound data or crash the server and lead to subsequent denial of service.

  • (CVE-2025-46817) An authenticated user may use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution.

  • (CVE-2025-49844) An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution.

  • (CVE-2025-32023) An authenticated user can use a specially crafted string to trigger a stack/heap out-of-bounds write on HyperLogLog operations, which can lead to remote code execution.

  • (CVE-2025-21605) An unauthenticated client can cause unlimited growth of output buffers until the server runs out of memory or is terminated, which can lead to denial-of-service.

Redis 7.2.x

  • Memory corruption in SLOT_INFO handling may allow an unauthenticated user to potentially run their own code.

  • A use-after-free in TLS pending-data processing may allow an authenticated user to cause a denial-of-service.

  • A vulnerability in the RESTORE command and in RDB loading allows an authenticated user to trigger a use-after-free in stream consumer groups via a specially crafted serialized payload, potentially resulting in remote code execution.

  • An ACL key-pattern bypass in GEORADIUS and GEORADIUSBYMEMBER may allow an authenticated user to write to keys outside their permitted key patterns.

  • An out-of-bounds read during command key extraction may cause the server to crash.

  • (CVE-2026-62356) An authenticated user may trigger a heap out-of-bounds write in RedisBloom by loading a specially crafted Count-Min Sketch (CMSketch) object, for example via the RESTORE command or a crafted RDB file.

  • RedisBloom: Out-of-bounds access in the TopK heap cleanup path.

  • (CVE-2026-23479) When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.

  • (CVE‑2026‑25243) A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-25588) A vulnerability in the RESTORE command, when used with the RedisTimeSeries module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE‑2026‑25589) A vulnerability in the RESTORE command, when used with the RedisBloom module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-23631) An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.

  • Insufficient sanitization of Lua script error messages can allow an authenticated user with EVAL permission to inject arbitrary RESP protocol responses, leading to denial of service, data manipulation, and connection pool poisoning.

  • RedisBloom: Integer overflow in TopK RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in td_histogram_t RDB loading may lead to heap buffer overflow.

  • RedisBloom: Missing validation in CuckooFilter RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in SBChain and CMSketch RDB loading may lead to heap out-of-bounds write.

  • Added validation of limits during RDB load and data creation to avoid resource exhaustion and Denial-of-Service (DoS) vulnerabilities.

  • RedisBloom: Restore invalid filter.

  • Integer overflow in hllPatLen.

  • RedisBloom: Cuckoo filter counter overflow.

  • RedisBloom: Invalid Bloom filters can cause arbitrary memory reads and writes.

  • RedisBloom: Reachable assert in TopK_Create

  • RedisBloom: Out-of-bounds access with empty Bloom chains.

  • RedisBloom: Division by zero in Cuckoo filter insertion.

  • (CVE-2025-46818) An authenticated user may use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user.

  • (CVE-2025-46819) An authenticated user may use a specially crafted LUA script to read out-of-bound data or crash the server and lead to subsequent denial of service.

  • (CVE-2025-46817) An authenticated user may use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution.

  • (CVE-2025-49844) An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution.

  • (CVE-2025-32023) An authenticated user can use a specially crafted string to trigger a stack/heap out-of-bounds write on HyperLogLog operations, which can lead to remote code execution.

  • (CVE-2025-21605) An unauthenticated client can cause unlimited growth of output buffers until the server runs out of memory or is terminated, which can lead to denial-of-service.

  • (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.

  • (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.

  • (CVE-2023-41056) In some cases, Redis may incorrectly handle resizing of memory buffers, which can result in incorrect accounting of buffer sizes and lead to heap overflow and potential remote code execution.

  • (CVE-2023-41053) Redis does not correctly identify keys accessed by SORT_RO and, as a result, may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. (Redis 7.2.1)

Redis 7.0.x

  • (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.

  • (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.

  • (CVE-2023-41056) In some cases, Redis may incorrectly handle resizing of memory buffers, which can result in incorrect accounting of buffer sizes and lead to heap overflow and potential remote code execution.

  • (CVE-2023-41053) Redis does not correctly identify keys accessed by SORT_RO and, as a result, may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. (Redis 7.0.13)

  • (CVE-2023-36824) Extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption, and potentially remote code execution. Specifically: using COMMAND GETKEYS* and validation of key names in ACL rules. (Redis 7.0.12)

  • (CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access. (Redis 7.0.11)

  • (CVE-2023-28425) Specially crafted MSETNX commands can lead to assertion and denial-of-service. (Redis 7.0.10)

  • (CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 7.0.9)

  • (CVE-2023-22458) Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands can lead to denial-of-service. (Redis 7.0.8)

  • (CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis can cause it to hang and consume 100% CPU time. (Redis 7.0.9)

  • (CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic. (Redis 7.0.8)

  • (CVE-2022-35951) Executing an XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument, may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. The problem affects Redis versions 7.0.0 or newer. (Redis 7.0.5)

  • (CVE-2022-31144) A specially crafted XAUTOCLAIM command on a stream key in a specific state may result in heap overflow and potentially remote code execution. The problem affects Redis versions 7.0.0 or newer. (Redis 7.0.4)

  • (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 7.0.12)

  • (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result in a crash of the redis-server process. This issue affects all versions of Redis. (Redis 7.0.0)

  • (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. (Redis 7.0.0)

Redis 6.2.x

  • Memory corruption in SLOT_INFO handling may allow an unauthenticated user to potentially run their own code.

  • A use-after-free in TLS pending-data processing may allow an authenticated user to cause a denial-of-service.

  • A vulnerability in the RESTORE command and in RDB loading allows an authenticated user to trigger a use-after-free in stream consumer groups via a specially crafted serialized payload, potentially resulting in remote code execution.

  • An ACL key-pattern bypass in GEORADIUS and GEORADIUSBYMEMBER may allow an authenticated user to write to keys outside their permitted key patterns.

  • An out-of-bounds read during command key extraction may cause the server to crash.

  • (CVE-2026-62356) An authenticated user may trigger a heap out-of-bounds write in RedisBloom by loading a specially crafted Count-Min Sketch (CMSketch) object, for example via the RESTORE command or a crafted RDB file.

  • RedisBloom: Out-of-bounds access in the TopK heap cleanup path.

  • (CVE-2026-23479) When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.

  • (CVE‑2026‑25243) A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-25588) A vulnerability in the RESTORE command, when used with the RedisTimeSeries module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE‑2026‑25589) A vulnerability in the RESTORE command, when used with the RedisBloom module, allows an authenticated attacker to trigger invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.

  • (CVE-2026-23631) An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with replica-read-only disabled, and exists in all versions of Redis with Lua scripting.

  • Insufficient sanitization of Lua script error messages can allow an authenticated user with EVAL permission to inject arbitrary RESP protocol responses, leading to denial of service, data manipulation, and connection pool poisoning.

  • RedisBloom: Integer overflow in TopK RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in td_histogram_t RDB loading may lead to heap buffer overflow.

  • RedisBloom: Missing validation in CuckooFilter RDB loading may lead to heap out-of-bounds access.

  • RedisBloom: Missing validation in SBChain and CMSketch RDB loading may lead to heap out-of-bounds write.

  • Added validation of limits during RDB load and data creation to avoid resource exhaustion and Denial-of-Service (DoS) vulnerabilities.

  • RedisBloom: Restore invalid filter.

  • Integer overflow in hllPatLen.

  • RedisBloom: Cuckoo filter counter overflow.

  • RedisBloom: Invalid Bloom filters can cause arbitrary memory reads and writes.

  • RedisBloom: Reachable assert in TopK_Create

  • RedisBloom: Out-of-bounds access with empty Bloom chains.

  • RedisBloom: Division by zero in Cuckoo filter insertion.

  • (CVE-2025-46818) An authenticated user may use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user.

  • (CVE-2025-46819) An authenticated user may use a specially crafted LUA script to read out-of-bound data or crash the server and lead to subsequent denial of service.

  • (CVE-2025-46817) An authenticated user may use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution.

  • (CVE-2025-49844) An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution.

  • (CVE-2025-32023) An authenticated user can use a specially crafted string to trigger a stack/heap out-of-bounds write on HyperLogLog operations, which can lead to remote code execution.

  • (CVE-2025-21605) An unauthenticated client can cause unlimited growth of output buffers until the server runs out of memory or is terminated, which can lead to denial-of-service.

  • (CVE-2024-31449) An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution.

  • (CVE-2024-31228) An authenticated user can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.

  • (CVE-2023-28856) Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that will crash Redis on access. (Redis 6.2.12)

  • (CVE-2023-25155) Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. (Redis 6.2.11)

  • (CVE-2023-22458) Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands can lead to denial-of-service. (Redis 6.2.9)

  • (CVE-2022-36021) String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis can cause it to hang and consume 100% CPU time. (Redis 6.2.11)

  • (CVE-2022-35977) Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic. (Redis 6.2.9)

  • (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (Redis 6.2.13)

  • (CVE-2022-24736) An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result in a crash of the redis-server process. This issue affects all versions of Redis. (Redis 6.2.7)

  • (CVE-2022-24735) By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. (Redis 6.2.7)

  • (CVE-2021-41099) Integer to heap buffer overflow handling certain string commands and network payloads, when proto-max-bulk-len is manually configured to a non-default, very large value. (Redis 6.2.6)

  • (CVE-2021-32762) Integer to heap buffer overflow issue in redis-cli and redis-sentinel parsing large multi-bulk replies on some older and less common platforms. (Redis 6.2.6)

  • (CVE-2021-32761) An integer overflow bug in Redis version 2.2 or newer can be exploited using the BITFIELD command to corrupt the heap and potentially result with remote code execution. (Redis 6.2.5)

  • (CVE-2021-32687) Integer to heap buffer overflow with intsets, when set-max-intset-entries is manually configured to a non-default, very large value. (Redis 6.2.6)

  • (CVE-2021-32675) Denial Of Service when processing RESP request payloads with a large number of elements on many connections. (Redis 6.2.6)

  • (CVE-2021-32672) Random heap reading issue with Lua Debugger. (Redis 6.2.6)

  • (CVE-2021-32628) Integer to heap buffer overflow handling ziplist-encoded data types, when configuring a large, non-default value for hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value. (Redis 6.2.6)

  • (CVE-2021-32627) Integer to heap buffer overflow issue with streams, when configuring a non-default, large value for proto-max-bulk-len and client-query-buffer-limit. (Redis 6.2.6)

  • (CVE-2021-32626) Specially crafted Lua scripts may result with Heap buffer overflow. (Redis 6.2.6)

  • (CVE-2021-32625) An integer overflow bug in Redis version 6.0 or newer can be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. (Redis 6.2.4)

  • (CVE-2021-29478) An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration value, creating a large set key that consists of integer values and using the COPY command to duplicate it. The integer overflow bug exists in all versions of Redis starting with 2.6, where it could result with a corrupted RDB or DUMP payload, but not exploited through COPY (which did not exist before 6.2). (Redis 6.2.3)

  • (CVE-2021-29477) An integer overflow bug in Redis version 6.0 or newer could be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. The integer overflow bug exists in all versions of Redis starting with 6.0. (Redis 6.2.3)

RATE THIS PAGE
Back to top ↑