Last 7 days
8
Features: 0
Changes: 6
Fixes: 2
Deprecations: 0
Redis
In-memory data store for caching, queues, and realtime workloads.
Latest Redis changelog updates, official release notes, breaking changes, security patches, pricing changes, and developer reactions in one product feed.
Follow this Redis release-notes page to spot useful features, risky migrations, noisy announcements, and source links before they hit your backlog.
Where Redis updates are checked
Changes.Watch links back to official changelog and release-note sources so summaries stay easy to verify.
Redis updates by type
Rolling windows show how many product updates landed in the last 7, 30, 90, and 365 days, grouped by existing changelog semantics.
8
16
20
50
Latest Redis changelog updates
Fixed multiple critical security vulnerabilities including CVE‑2026‑62356, heap out‑of‑bounds write, use‑after‑free, and TLS client certificate authentication bypass.
Fixed several critical CVE‑2026‑62356 vulnerabilities: buffer overflow, out‑of‑bounds access, use‑after‑free, and ACL bypass in commands like SORT, GEORADIUS, and XREADGROUP.
Fixed multiple heap OOB write and use‑after‑free vulnerabilities in CMSketch loading, TopK cleanup, and TLS pending data handling.
Fixed multiple heap and out‑of‑bounds write vulnerabilities (CVE‑2026‑62356) including CMSketch RDB loading and TopK cleanup
Fixed multiple memory corruption vulnerabilities including OOB writes, use‑after‑free, and out‑of‑bounds reads in RDB loading, CMSketch, TopK cleanup, TLS pending data, ACL checks, and vector set handling.
Fixed multiple use‑after‑free vulnerabilities affecting TLS pending data handling and the blocked client list.
Fixed multiple use‑after‑free vulnerabilities in TLS pending data handling and blocked‑client list processing.
Fixed a use‑after‑free vulnerability in TLS pending‑data handling when a command closes another pending connection.
Introduces compact hash encoding and HIMPORT for high‑throughput bulk hash insertion, plus TLS peer‑certificate authentication for server‑to‑server connections.
- Fixed a security vulnerability in RedisBloom and TDigest where crafted RESTORE payloads could cause out-of-bounds writes.
Security fixes patch crafted RESTORE payloads that could cause use‑after‑free and out‑of‑bounds writes in RedisBloom/TDigest, preventing potential remote code execution.
Fixed use‑after‑free and out‑of‑bounds write vulnerabilities in RESTORE handling for stream consumer groups, RedisBloom, and TDigest, preventing remote code execution.
Fixed use‑after‑free vulnerability in RESTORE for stream consumer groups, preventing potential remote code execution
Security fix addressing a crafted stream RESTORE payload that could cause two consumers to share the same NACK.
Fixed a vulnerability where a crafted stream RESTORE payload could cause two consumers to share the same NACK, leading to a use‑after‑free.
Fixes a security vulnerability where a crafted stream RESTORE payload could cause two consumers to share the same NACK, leading to a use‑after‑free.
Critical bug fixes across Redis core and modules: resolves start failures on AArch64, memory accounting errors, Lua debugger copy issues, and XREADGROUP consumer inconsistencies.
- Fixed critical bugs causing crashes, memory mis‑accounting, server hangs, and ACL/AOF loading failures on AArch64 and other platforms.
Critical bug fixes across Redis core and modules: resolve AArch64 startup failure, cluster buffer overflow, shutdown client reset, and stream XTRIM/XADD edge cases.
Added new Array data structure and subkey notifications for hash fields, plus INCREX window counter rate limiter and XNACK stream command
Updated docs call out persistence settings that can surprise small teams.
Patched several remote‑code‑execution vulnerabilities (CVE‑2026‑23479, ‑25243, ‑23631, ‑25588, ‑25589) affecting unblock client flow, RESTORE, Lua, and Time‑Series modules.
Patched multiple critical Use‑After‑Free and invalid memory access vulnerabilities (CVE‑2026‑23479,‑25243,‑23631,‑25588‑25589) that could lead to remote code execution.
Patched multiple remote code execution vulnerabilities (CVE‑2026‑23479, 25243, 23631, 25588, 25589) affecting client flow, Lua, and RESTORE across modules.
Security patches address multiple RCE vulnerabilities (CVE‑2026‑23479, CVE‑2026‑25243, CVE‑2026‑23631) related to use‑after‑free and invalid memory access.
Fixed multiple remote code execution vulnerabilities (CVE‑2026‑23479, CVE‑2026‑25243, CVE‑2026‑23631) related to use‑after‑free and memory errors.
Fixed CVE‑2026‑25243: corrected invalid memory access in RESTORE to prevent remote code execution.
Added subkey notification for hash fields and new FT.HYBRID arguments (KNN clause and profiling support).
Added new capabilities including GCRA rate‑limiter module, XNACK stream command, JSON.SET FPHA argument, COUNT aggregator for ZUNION/ZINTER, multi‑aggregator support in TimeSeries, and module API for key metadata
Fixed multiple bugs including potential use‑after‑free, crashes during command processing and ACL checks, and memory‑leak issues
Imported from changelog source; review and generate a concise summary before publishing.
Fixed a security vulnerability where crafted CRLF sequences in Redis error replies could be used to manipulate data read by a connection.
Fix a vulnerability where CR\r\n sequences could be injected into Redis error replies, allowing data manipulation by a malicious user.
Fix prevents data manipulation by injecting CRLF sequences into Redis error replies
Fix for CRLF injection in Redis error replies
Fixed a security issue where injected CRLF sequences could manipulate data read from Redis error replies.
GA release of Redis 8.6 delivering major performance gains and reduced memory usage for hashes and sorted sets, plus per‑type memory histograms
Security patches applied to RedisTimeSeries, RedisJSON, and RedisBloom modules.
Security patches for RedisTimeSeries and RedisJSON to hide PII and fix malformed log messages.
Introduces new atomic string operations (SET compare-and-set/delete, MSETEX) and stream enhancements (XREADGROUP CLAIM) along with atomic slot migration and per-slot usage metrics.
Fixed CVE‑2025‑62507 and multiple memory‑corruption bugs in XACKDEL, HGETEX, HyperLogLog, Cuckoo and Bloom filters.
Fixed multiple critical crashes and memory safety issues across data structures (HGETEX, HyperLogLog, Cuckoo filter, Bloom filter, Top K).
Fixed a potential crash in HyperLogLog when processing entries larger than 2 GB.
Critical bug fix preventing crashes in HyperLogLog when processing entries larger than 2 GB
Critical fix for potential crash in HyperLogLog when processing entries larger than 2 GB.
Security patches address multiple Lua RCE vulnerabilities (CVE‑2025‑49844, 46817‑46819) and other critical issues.
Critical security updates addressing multiple CVEs in Lua scripting (remote code execution, integer overflow, context execution, out‑of‑bounds read)
Fix multiple critical Lua‑related security vulnerabilities (CVE‑2025‑49844, CVE‑2025‑46817/46818/46819).
Patched several critical Lua script vulnerabilities (CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819).
Fix multiple Lua script vulnerabilities (CVE‑2025‑49844, CVE‑2025‑46817‑46819)
Fixed stability issues: corrected potential INFO KEYSIZES histogram errors in cluster mode, prevented XADD/XTRIM crashes after RDB load, and addressed a FLUSHDB crash (MOD 10681).
Introduced new stream commands XDELEX and XACKDEL, extended XADD/XTRIM, added bitmap BITOP operators (DIFF, DIFF1, ANDOR, ONE), and a new SVS VAMANA vector index with compression
Security fixes address out-of-bounds write in HyperLogLog commands (CVE-2025-32023, CVE-2025-48367) and improve connection acceptance handling after errors.
Security patches addressing CVE-2025-32023 and CVE-2025-48367 (out-of-bounds write in HyperLogLog commands).
Fix out-of-bounds write in HyperLogLog commands (CVE‑2025‑32023).
Fixed out-of-bounds write vulnerability in HyperLogLog commands (CVE‑2025‑32023, CVE‑2025‑48367).
Added new BITOP operators (DIFF, DIFF1, ANDOR, ONE) and VSIM WITHATTRIBS option, plus new CLIENT INFO/LIST metrics
Patched CVE‑2025‑27151: resolved AOF check stack overflow that could lead to remote code execution.
Patched CVE‑2025‑27151 preventing a stack overflow in Redis AOF check that could lead to RCE.
Security fix for CVE‑2025‑27151 addressing Redis AOF stack overflow and potential RCE
Improved performance and resource utilization, including faster VSIM FILTER parsing
Redis 8.0 GA integrates RediSearch, RedisJSON, RedisTimeSeries, RedisBloom and adds Redis Query Engine plus nine new data structures, new ACL categories, and hash commands (HGETDEL, HGETEX, HSETEX).
Fix security vulnerability (CVE‑2025‑21605) allowing unauthenticated buffer growth
Fixed CVE‑2025‑21605 where an unauthenticated client could cause unlimited growth of output buffers, leading to a potential denial‑of‑service.
Fixed CVE‑2025‑21605 allowing unauthenticated clients to cause unbounded output buffer growth.
Added three new hash commands (HGETDEL, HGETEX, HSETEX) and replication offset to AOF for more reliable recovery.
Added a new I/O threading implementation and an improved replication mechanism, boosting throughput on multi‑core systems
Fixed critical security vulnerabilities (CVE‑2024‑46981 remote code execution, CVE‑2024‑51741 denial‑of‑service) and related ACL selector DoS.
Critical security fixes addressing remote code execution (CVE‑2024‑51741) and denial‑of‑service vulnerabilities (CVE‑2024‑46981).
Security fix for CVE‑2024‑46981 addressing remote code execution via Lua script commands
Fix Lua library command stack overflow leading to potential remote code execution (CVE‑2024‑31449).
Addressed multiple CVEs (2024‑31449, 2024‑31227, 2024‑31228) fixing stack overflow, remote code execution, and denial‑of‑service vulnerabilities.
Patched multiple vulnerabilities (CVE‑2024‑31449, CVE‑2024‑31227, CVE‑2024‑31228) affecting Lua library stack overflow, remote code execution, and denial‑of‑service.
Added per‑field hash expiration with RDB format changes and renamed subexpiry metrics/INFO field
Fix cluster slot handling for failed replicas in single‑shard setups
Critical security fix for CVE‑2023‑41056 addressing a memory buffer resize overflow that could lead to remote code execution.
Fixed CVE‑2023‑41056 by correcting Redis memory buffer resizing logic to prevent heap overflow.
Fixed file descriptor leak preventing deleted files from freeing disk space on replicas
Patched CVE‑2023‑45145 by correcting the listen/chmod order to prevent a race condition that could bypass Unix socket permissions.
Fix race condition allowing bypass of Unix socket permissions (CVE‑2023‑45145)
Fixed race condition where incorrect order of listen() and chmod() calls could bypass Unix socket permissions (CVE‑2023‑45145).
Fix CVE‑2023‑41053: Redis SORT RO could expose keys not authorized by ACL, addressing a security vulnerability.
Fixed CVE‑2023‑41053: corrected ACL enforcement for SORT RO to prevent unauthorized key access.
First stable release of Redis 7.2 with multiple bug fixes and stability improvements
Fix critical security issues (CVE‑2022‑24834, CVE‑2023‑36824) that could cause heap overflow, corruption, and remote code execution via Lua scripting and COMMAND GETKEYS/ACL validation.
Fix CVE‑2022‑24834: heap overflow in Redis Lua scripting (cjson/cmsgpack) leading to potential remote code execution.
Patched CVE-2022-24834: fixed heap overflow in cjson/cmsgpack triggered by crafted Lua scripts, preventing potential remote code execution.
Patched CVE‑2023‑28856 to stop HINCRBYFLOAT from creating malformed hash fields that could crash Redis
Patched CVE‑2023‑28856 to stop HINCRBYFLOAT from creating invalid hash fields that could crash Redis
Patched CVE-2023-28856: authenticated HINCRBYFLOAT could create an invalid hash field leading to crashes.
Patched CVE-2023-28425: MSETNX command denial-of-service vulnerability.
Patched critical security issues (CVE-2023-25155, CVE-2022-36021) that could cause crashes or DoS.
Patch CVE‑2023‑25155 integer overflow in SRANDMEMBER/ZRANDMEMBER/HRANDFIELD that could crash Redis.
Fix critical security vulnerabilities: CVE‑2023‑25155 integer overflow in SRANDMEMBER/ZRANDMEMBER/HRANDFIELD and CVE‑2022‑36021 DoS via crafted patterns in SCAN/KEYS.
Reverts the recent change to KEYS introduced by the client output buffer limit fix.
Patched CVE‑2022‑35977 integer overflow in SETRANGE and SORT/SORT RO commands.
Patch integer overflow vulnerabilities in SETRANGE, SORT/SORT RO, HRANDFIELD, and ZRANDMEMBER (CVE‑2022‑35977, CVE‑2023‑22458) to prevent OOM panics and DoS
Patched integer overflow vulnerabilities (CVE‑2022‑35977, CVE‑2023‑22458) affecting SETRANGE, SORT, HRANDFIELD, and ZRANDMEMBER commands.
Fix regression in Geo command distance replies introduced in Redis 7.0.6
Added new module APIs (RM SetContextUser, SetModuleUserACLString, GetModuleUserACLString) and fixed related module crashes.
Optimized ZRANGESTORE conversion for large sorted sets, improving performance and resource usage.
Security fix for CVE‑2022‑35951 integer/heap overflow in XAUTOCLAIM leading to remote code execution.
Fixed heap overflow in XAUTOCLAIM command that could lead to remote code execution (CVE-2022-31144).
Performance and resource utilization improvements such as optimized ZRANGESTORE conversion, faster PING on large clusters, and quicker cluster-mode restarts
Corrected SET and BITFIELD commands being mistakenly marked as movablekeys, eliminating unnecessary roundtrips in cluster clients.
Added read‑only script support with new COMMAND flags and enhanced CLI/config handling, plus new module API functions and isolated network metrics.
Fixed critical vulnerabilities (CVE‑2022‑24736, CVE‑2022‑24735) addressing Lua script crashes and privilege escalation.
- Security patches for CVE‑2022‑24736 (NULL pointer crash) and CVE‑2022‑24735 (Lua code injection) in Redis’s Lua engine.
Patched multiple CVE‑2021 heap buffer overflow, DoS, and Lua debugging vulnerabilities affecting proto settings, intsets, ziplists, streams, and Lua scripts.
Address multiple integer-to-heap buffer overflow vulnerabilities across Redis components (e.g., CVE‑2021‑41099, CVE‑2021‑32762, CVE‑2021‑32687, CVE‑2021‑32628)
Addresses multiple heap buffer overflow vulnerabilities (CVE‑2021‑41099,‑32762,‑32687,‑32628,‑32627) affecting string commands, CLI, intsets, ziplist, and streams when non‑default large configuration values are used.
Fix integer overflow in BITFIELD on 32‑bit builds (CVE‑2021‑32761) preventing remote code execution
Fix integer overflow in BITFIELD and related bit commands on 32‑bit builds (CVE‑2021‑32761) and add TCP keepalive for inbound cluster bus connections.
Fix integer overflow in BITFIELD on 32‑bit systems (CVE‑2021‑32761) preventing potential remote code execution.
Fixed critical security vulnerability (CVE‑2021‑32625) in STRALGO LCS command that could lead to remote code execution.
Fixed integer overflow in STRALGO LCS (CVE‑2021‑32625) that could lead to remote code execution
Patched integer overflow vulnerabilities in STRALGO LCS (CVE‑2021‑29477) and COPY command (CVE‑2021‑29478) to prevent remote code execution.
Fixes two critical integer overflow vulnerabilities (CVE‑2021‑29477, CVE‑2021‑29478) that could lead to remote code execution.
Fixed numerous regressions affecting ACL Pub/Sub permissions, CONFIG REWRITE, BGSAVE/AOF, replication slowdown, and performance issues such as BRPOP and timer loops
Fixed multiple bugs including sanitize dump payload for streams, prevented client query buffer limit <1 MiB, and fixed a crash in CLIENT INFO via RM Call
Fix compilation error on non-glibc systems when jemalloc is disabled.
Fix compilation error on non‑glibc systems when jemalloc is disabled.
Imported from changelog source; review and generate a concise summary before publishing.
Fixed integer overflow on 32‑bit builds (CVE‑2021‑21309) by enforcing a safe default bulk size.
Fix integer overflow vulnerability on 32‑bit builds (CVE‑2021‑21309) and add ARM64 kernel bug check, raising security urgency for affected platforms.
Updated command semantics: SWAPDB now invalidates WATCHed keys, SORT behaves differently on writable replicas, and EXISTS/OBJECT no longer affect LRU or expose expired keys.