Redis

Summary

- Fixed critical bugs causing crashes, memory mis‑accounting, server hangs, and ACL/AOF loading failures on AArch64 and other platforms.

Summary

Critical bug fixes across Redis core and modules: resolve AArch64 startup failure, cluster buffer overflow, shutdown client reset, and stream XTRIM/XADD edge cases.

Summary

Added new Array data structure and subkey notifications for hash fields, plus INCREX window counter rate limiter and XNACK stream command

Summary

Updated docs call out persistence settings that can surprise small teams.

Summary

Patched several remote‑code‑execution vulnerabilities (CVE‑2026‑23479, ‑25243, ‑23631, ‑25588, ‑25589) affecting unblock client flow, RESTORE, Lua, and Time‑Series modules.

Summary

Patched multiple critical Use‑After‑Free and invalid memory access vulnerabilities (CVE‑2026‑23479,‑25243,‑23631,‑25588‑25589) that could lead to remote code execution.

Summary

Patched multiple remote code execution vulnerabilities (CVE‑2026‑23479, 25243, 23631, 25588, 25589) affecting client flow, Lua, and RESTORE across modules.

Summary

Security patches address multiple RCE vulnerabilities (CVE‑2026‑23479, CVE‑2026‑25243, CVE‑2026‑23631) related to use‑after‑free and invalid memory access.

Summary

Fixed multiple remote code execution vulnerabilities (CVE‑2026‑23479, CVE‑2026‑25243, CVE‑2026‑23631) related to use‑after‑free and memory errors.

Summary

Fixed CVE‑2026‑25243: corrected invalid memory access in RESTORE to prevent remote code execution.

Summary

Added subkey notification for hash fields and new FT.HYBRID arguments (KNN clause and profiling support).

Summary

Added new capabilities including GCRA rate‑limiter module, XNACK stream command, JSON.SET FPHA argument, COUNT aggregator for ZUNION/ZINTER, multi‑aggregator support in TimeSeries, and module API for key metadata

Summary

Fixed multiple bugs including potential use‑after‑free, crashes during command processing and ACL checks, and memory‑leak issues

Summary

Imported from changelog source; review and generate a concise summary before publishing.

Summary

Fixed a security vulnerability where crafted CRLF sequences in Redis error replies could be used to manipulate data read by a connection.

Summary

Fix a vulnerability where CR\r\n sequences could be injected into Redis error replies, allowing data manipulation by a malicious user.

Summary

Fix prevents data manipulation by injecting CRLF sequences into Redis error replies

Summary

Fix for CRLF injection in Redis error replies

Summary

Fixed a security issue where injected CRLF sequences could manipulate data read from Redis error replies.

Summary

GA release of Redis 8.6 delivering major performance gains and reduced memory usage for hashes and sorted sets, plus per‑type memory histograms

Summary

Security patches applied to RedisTimeSeries, RedisJSON, and RedisBloom modules.

Summary

Security patches for RedisTimeSeries and RedisJSON to hide PII and fix malformed log messages.

Summary

Introduces new atomic string operations (SET compare-and-set/delete, MSETEX) and stream enhancements (XREADGROUP CLAIM) along with atomic slot migration and per-slot usage metrics.

Summary

Fixed CVE‑2025‑62507 and multiple memory‑corruption bugs in XACKDEL, HGETEX, HyperLogLog, Cuckoo and Bloom filters.

Summary

Fixed multiple critical crashes and memory safety issues across data structures (HGETEX, HyperLogLog, Cuckoo filter, Bloom filter, Top K).

Summary

Fixed a potential crash in HyperLogLog when processing entries larger than 2 GB.

Summary

Critical bug fix preventing crashes in HyperLogLog when processing entries larger than 2 GB

Summary

Critical fix for potential crash in HyperLogLog when processing entries larger than 2 GB.

Summary

Security patches address multiple Lua RCE vulnerabilities (CVE‑2025‑49844, 46817‑46819) and other critical issues.

Summary

Critical security updates addressing multiple CVEs in Lua scripting (remote code execution, integer overflow, context execution, out‑of‑bounds read)

Summary

Fix multiple critical Lua‑related security vulnerabilities (CVE‑2025‑49844, CVE‑2025‑46817/46818/46819).

Summary

Patched several critical Lua script vulnerabilities (CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819).

Summary

Fix multiple Lua script vulnerabilities (CVE‑2025‑49844, CVE‑2025‑46817‑46819)

Summary

Fixed stability issues: corrected potential INFO KEYSIZES histogram errors in cluster mode, prevented XADD/XTRIM crashes after RDB load, and addressed a FLUSHDB crash (MOD 10681).

Summary

Introduced new stream commands XDELEX and XACKDEL, extended XADD/XTRIM, added bitmap BITOP operators (DIFF, DIFF1, ANDOR, ONE), and a new SVS VAMANA vector index with compression

Summary

Security fixes address out-of-bounds write in HyperLogLog commands (CVE-2025-32023, CVE-2025-48367) and improve connection acceptance handling after errors.

Summary

Security patches addressing CVE-2025-32023 and CVE-2025-48367 (out-of-bounds write in HyperLogLog commands).

Summary

Fix out-of-bounds write in HyperLogLog commands (CVE‑2025‑32023).

Summary

Fixed out-of-bounds write vulnerability in HyperLogLog commands (CVE‑2025‑32023, CVE‑2025‑48367).

Summary

Added new BITOP operators (DIFF, DIFF1, ANDOR, ONE) and VSIM WITHATTRIBS option, plus new CLIENT INFO/LIST metrics

Summary

Patched CVE‑2025‑27151: resolved AOF check stack overflow that could lead to remote code execution.

Summary

Patched CVE‑2025‑27151 preventing a stack overflow in Redis AOF check that could lead to RCE.

Summary

Security fix for CVE‑2025‑27151 addressing Redis AOF stack overflow and potential RCE

Summary

Improved performance and resource utilization, including faster VSIM FILTER parsing

Summary

Redis 8.0 GA integrates RediSearch, RedisJSON, RedisTimeSeries, RedisBloom and adds Redis Query Engine plus nine new data structures, new ACL categories, and hash commands (HGETDEL, HGETEX, HSETEX).

Summary

Fix security vulnerability (CVE‑2025‑21605) allowing unauthenticated buffer growth

Summary

Fixed CVE‑2025‑21605 where an unauthenticated client could cause unlimited growth of output buffers, leading to a potential denial‑of‑service.

Summary

Fixed CVE‑2025‑21605 allowing unauthenticated clients to cause unbounded output buffer growth.

Summary

Added three new hash commands (HGETDEL, HGETEX, HSETEX) and replication offset to AOF for more reliable recovery.

Summary

Added a new I/O threading implementation and an improved replication mechanism, boosting throughput on multi‑core systems

Summary

Fixed critical security vulnerabilities (CVE‑2024‑46981 remote code execution, CVE‑2024‑51741 denial‑of‑service) and related ACL selector DoS.

Summary

Critical security fixes addressing remote code execution (CVE‑2024‑51741) and denial‑of‑service vulnerabilities (CVE‑2024‑46981).

Summary

Security fix for CVE‑2024‑46981 addressing remote code execution via Lua script commands

Summary

Fix Lua library command stack overflow leading to potential remote code execution (CVE‑2024‑31449).

Summary

Addressed multiple CVEs (2024‑31449, 2024‑31227, 2024‑31228) fixing stack overflow, remote code execution, and denial‑of‑service vulnerabilities.

Summary

Patched multiple vulnerabilities (CVE‑2024‑31449, CVE‑2024‑31227, CVE‑2024‑31228) affecting Lua library stack overflow, remote code execution, and denial‑of‑service.

Summary

Added per‑field hash expiration with RDB format changes and renamed subexpiry metrics/INFO field

Summary

Fix cluster slot handling for failed replicas in single‑shard setups

Summary

Critical security fix for CVE‑2023‑41056 addressing a memory buffer resize overflow that could lead to remote code execution.

Summary

Fixed CVE‑2023‑41056 by correcting Redis memory buffer resizing logic to prevent heap overflow.

Summary

Fixed file descriptor leak preventing deleted files from freeing disk space on replicas

Summary

Patched CVE‑2023‑45145 by correcting the listen/chmod order to prevent a race condition that could bypass Unix socket permissions.

Summary

Fix race condition allowing bypass of Unix socket permissions (CVE‑2023‑45145)

Summary

Fixed race condition where incorrect order of listen() and chmod() calls could bypass Unix socket permissions (CVE‑2023‑45145).

Summary

Fix CVE‑2023‑41053: Redis SORT RO could expose keys not authorized by ACL, addressing a security vulnerability.

Summary

Fixed CVE‑2023‑41053: corrected ACL enforcement for SORT RO to prevent unauthorized key access.

Summary

First stable release of Redis 7.2 with multiple bug fixes and stability improvements

Summary

Fix critical security issues (CVE‑2022‑24834, CVE‑2023‑36824) that could cause heap overflow, corruption, and remote code execution via Lua scripting and COMMAND GETKEYS/ACL validation.

Summary

Fix CVE‑2022‑24834: heap overflow in Redis Lua scripting (cjson/cmsgpack) leading to potential remote code execution.

Summary

Patched CVE-2022-24834: fixed heap overflow in cjson/cmsgpack triggered by crafted Lua scripts, preventing potential remote code execution.

Summary

Patched CVE‑2023‑28856 to stop HINCRBYFLOAT from creating malformed hash fields that could crash Redis

Summary

Patched CVE‑2023‑28856 to stop HINCRBYFLOAT from creating invalid hash fields that could crash Redis

Summary

Patched CVE-2023-28856: authenticated HINCRBYFLOAT could create an invalid hash field leading to crashes.

Summary

Patched CVE-2023-28425: MSETNX command denial-of-service vulnerability.

Summary

Patched critical security issues (CVE-2023-25155, CVE-2022-36021) that could cause crashes or DoS.

Summary

Patch CVE‑2023‑25155 integer overflow in SRANDMEMBER/ZRANDMEMBER/HRANDFIELD that could crash Redis.

Summary

Fix critical security vulnerabilities: CVE‑2023‑25155 integer overflow in SRANDMEMBER/ZRANDMEMBER/HRANDFIELD and CVE‑2022‑36021 DoS via crafted patterns in SCAN/KEYS.

Summary

Reverts the recent change to KEYS introduced by the client output buffer limit fix.

Summary

Patched CVE‑2022‑35977 integer overflow in SETRANGE and SORT/SORT RO commands.

Summary

Patch integer overflow vulnerabilities in SETRANGE, SORT/SORT RO, HRANDFIELD, and ZRANDMEMBER (CVE‑2022‑35977, CVE‑2023‑22458) to prevent OOM panics and DoS

Summary

Patched integer overflow vulnerabilities (CVE‑2022‑35977, CVE‑2023‑22458) affecting SETRANGE, SORT, HRANDFIELD, and ZRANDMEMBER commands.

Summary

Fix regression in Geo command distance replies introduced in Redis 7.0.6

Summary

Added new module APIs (RM SetContextUser, SetModuleUserACLString, GetModuleUserACLString) and fixed related module crashes.

Summary

Optimized ZRANGESTORE conversion for large sorted sets, improving performance and resource usage.

Summary

Security fix for CVE‑2022‑35951 integer/heap overflow in XAUTOCLAIM leading to remote code execution.

Summary

Fixed heap overflow in XAUTOCLAIM command that could lead to remote code execution (CVE-2022-31144).

Summary

Performance and resource utilization improvements such as optimized ZRANGESTORE conversion, faster PING on large clusters, and quicker cluster-mode restarts

Summary

Corrected SET and BITFIELD commands being mistakenly marked as movablekeys, eliminating unnecessary roundtrips in cluster clients.

Summary

Added read‑only script support with new COMMAND flags and enhanced CLI/config handling, plus new module API functions and isolated network metrics.

Summary

Fixed critical vulnerabilities (CVE‑2022‑24736, CVE‑2022‑24735) addressing Lua script crashes and privilege escalation.

Summary

- Security patches for CVE‑2022‑24736 (NULL pointer crash) and CVE‑2022‑24735 (Lua code injection) in Redis’s Lua engine.

Summary

Patched multiple CVE‑2021 heap buffer overflow, DoS, and Lua debugging vulnerabilities affecting proto settings, intsets, ziplists, streams, and Lua scripts.

Summary

Address multiple integer-to-heap buffer overflow vulnerabilities across Redis components (e.g., CVE‑2021‑41099, CVE‑2021‑32762, CVE‑2021‑32687, CVE‑2021‑32628)

Summary

Addresses multiple heap buffer overflow vulnerabilities (CVE‑2021‑41099,‑32762,‑32687,‑32628,‑32627) affecting string commands, CLI, intsets, ziplist, and streams when non‑default large configuration values are used.