Redis

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection

This is the General Availability release of Redis 8.10 in Redis Open Source.

Major changes compared to 8.8

• Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
• New command: HIMPORT - high-throughput compact hash bulk insertion
• TLS peer certificate-based server-to-server authentication
• New commands: LMOVEM, BLMOVEM - move multiple elements between lists
• New command: SUNIONCARD - get the cardinality of the union of multiple sets
• New command: SDIFFCARD - get the cardinality of the difference between sets
• New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
• XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
• New command: FT.ALIASLIST - get all aliases for the index
• Stemmer support for Malay and Tagalog languages
• JSONPath extensions
• New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
• New command: TS.READ - optionally blocking read
• New command: TS.QUERYLABELS - Get a list of labels and label-values
• New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
• Performance improvements

Binary distributions

• Alpine and Debian Docker images - https://hub.docker.com/_/redis
• Install using snap - see https://github.com/redis/redis-snap
• Install using brew - see https://github.com/redis/homebrew-redis
• Install using RPM - see https://github.com/redis/redis-rpm
• Install using Debian APT - see https://github.com/redis/redis-debian

Operating systems we test Redis 8.10 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

Bug fixes (compared to 8.10-RC2)

• #15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
• #15453 Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
• #15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed
• #15518 notify modules when node's own ip/port changes
• #15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
• RediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)
• RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)
• RediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)
• RediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)
• RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)
• RediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)

SECURITY: There is a security fix in the release.

Security fixes

• RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

SECURITY: There are security fixes in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
• RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

• RedisBloom/RedisBloom#1021 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
• RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

• RedisBloom/RedisBloom#1020 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
• RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

• RedisBloom/RedisBloom#1019 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

This is the second Release Candidate of Redis 8.10 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

Bug fixes (compared to 8.10-RC1)

• A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
• A typo in release.h that could cause build failures

This is the first Release Candidate of Redis 8.10 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

Headlines:

Redis 8.10 introduces new features and performance improvements.

Operating systems we test Redis 8.10 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

New Features (compared to 8.8)

• #15364 Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
• #15366 Replication stream compression to reduce bandwidth consumption between primaries and replicas
• #15364 New command: HIMPORT - high-throughput compact hash bulk insertion
• #15405 New commands: LMOVEM, BLMOVEM - move multiple elements between lists
• #14893 New command: SUNIONCARD - get the cardinality of the union of multiple sets
• #15278 New command: SDIFFCARD - get the cardinality of the difference between sets
• #15441 New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
• #15282 XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
• #15337 New SCRIPT_RUNNER command flag: flag commands that execute scripts or functions
• #15347 SLOWLOG GET - new reply argument: total argument count
• RediSearch/RediSearch#9626 New command: FT.ALIASLIST - get all aliases for the index (RED-197340)
• RediSearch/RediSearch#9052 New Languages Search: Stemmer support for Malay and Tagalog languages (RED-132425)
• RediSearch/RediSearch#9291 FT.AGGREGATE now supports whole-document fetching using COLLECT, in-group SORTBY/LIMIT, and deduplication control within a single query. (RED-177887)
• RediSearch/RediSearch#8169, RediSearch/RediSearch#8236, RediSearch/RediSearch#9234, RediSearch/RediSearch#9443 — FT.SEARCH, FT.AGGREGATE, FT.HYBRID: enforce query TIMEOUT more strictly; long-running queries require vertical scaling (multi-threaded execution). (RED-132340)
  • use FAIL when correctness requires rejecting timed-out queries. With search-workers > 0` (the default), the timeout is enforced preemptively
  • use RETURN when best-effort partial results are acceptable and strictness not enforced at post-processing time.
  • use RETURN_STRICT when best-effort partial results are acceptable and strictness enforced on post-processing.
  • New parameter search-global-timeout acting as cap value to timeout setting on query time TIMEOUT param
• RedisJSON/RedisJSON#1602, RedisJSON/RedisJSON#1603, RedisJSON/RedisJSON#1604, RedisJSON/RedisJSON#1607, RedisJSON/RedisJSON#1618 JSONPath extensions (MOD-16274, MOD-16275):
  • Projection expressions at the top level of a JSONPath query
  • == and != can now compare any literal, including array and object literals
  • Filter negation operator: !
  • size/sizeof and empty operators on string, array, object, and nodelist
  • in and nin operators: membership test on an array and nodelist
  • Operators on numbers: binary -, +, *, /, %, and unary - and +
  • Operator on object: ~
  • length() function on array, object, and string
  • Functions on number: abs(), ceiling(), floor()
  • Functions on string: match(), search()
  • Strings concatenation with concat()
  • Functions on array: first(), last(), index(), append()
  • Aggregation functions on array: min(), max(), avg(), sum(), stddev()
  • Function on object: keys()
  • Function on nodelist: count()
  • Function on nodelist with exactly one node: value()
  • Relations functions on array and nodelist: subsetof(), anyof(), noneof()
• RedisTimeSeries/RedisTimeSeries#2052 New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp (RED-149232)
• RedisTimeSeries/RedisTimeSeries#2054 New command: TS.READ - optionally blocking read (RED-132421)
• RedisTimeSeries/RedisTimeSeries#2090 New command: TS.QUERYLABELS - Get a list of labels and label-values (RED-132355)
• RedisTimeSeries/RedisTimeSeries#2072 New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples (RED-132536)

Bug fixes (compared to 8.8.0)

• #15478 SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD, XREADGROUP - ACL permission bypass
• #15329, #15467 - I/O thread busy looping for replica clients
• #15466 Duplicate KeyMeta restoration in RESTORE-based AOF rewrites
• #15462 MEMORY USAGE over-reports memory consumption
• #15447 Full sync under heavy write load
• #15412 Unit mismatch disables the FAST expire cycle stale trigger
• #15392 Crash on VRANDMEMBER with LLONG_MIN count
• #15409 CONFIG SET - crash on of TLS options in non-TLS builds
• #15371 ACL key-name leak in BCAST client-side caching invalidations
• #15433 Signed overflow in BITFIELD offset parsing
• #15446 The select-based event loop backend enqueues registered file descriptors that select() did not mark ready
• #15309 mem_clients_normal drift when a replica drops its cached master after a failed partial resync
• #15357 Crash on missing module numeric config
• #15377 In-progress atomic slot migration tasks keep running on RM_ResetDataset and RM_RdbLoad
• #15391, #15356, #15436 NULL dereference
• #15390 Overflow on memory unit conversions
• #15291 SET does not enforce mutually exclusive NX/XX and IF* options
• #15322 CONFIG SET does not reject duplicate arguments when using both primary name and alias
• #15407 LSET out-of-range 64-bit index truncation
• #15308 Improve RDB load robustness (streams)
• #15263 Tighter cluster bus parsing for PING, PONG, and MEET packets
• #15247 Partial crash log on LoongArch architecture
• #15270 VADD ... CAS SETATTR - wrong attributes count
• RediSearch/RediSearch#10375 FT.CURSOR READ: crash after the underlying index was dropped (MOD-16703)
• RediSearch/RediSearch#10408 FT.SEARCH with LIMIT returns too many results in cluster mode over RESP3 (MOD-16767)
• RediSearch/RediSearch#10420 [FT.INFO](http://ft.info/) could report incorrect values for multi-value TAG fields after document updates (MOD-16745)
• RediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes with an INDEXMISSING field (MOD-16940)
• RediSearch/RediSearch#10392 Vector search: crash (SIGSEGV) in FP32/L2 distance computation on x86 without AVX support, affecting certain vector dimensions (MOD-16730)
• RediSearch/RediSearch#9963 Range query returns incomplete results when the lower bound is an excluded empty string (MOD-15897)
• RediSearch/RediSearch#10066 FT.AGGREGATE .. WITHCOUNT coordinator leaks resources on timeout (MOD-16210)
• RediSearch/RediSearch#10247 Local FT.HYBRID ignores ON_TIMEOUT RETURN_STRICT and continues execution past the deadline (MOD-16492)
• RediSearch/RediSearch#10255 Blocked search clients trigger unnecessary query dumps, adding CPU and log overhead (MOD-16518)
• RediSearch/RediSearch#10151 FT.HYBRID supports EXPLAINSCORE, exposing the fusion method (RRF or LINEAR) (MOD-10044)
• RedisJSON/RedisJSON#1542, RedisJSON/RedisJSON#1543 Wrong results when evaluating paths with recursive descent (MOD-6722, MOD-14664)
• RedisJSON/RedisJSON#1554 Any literal that starts with true/false/null is interpreted as true/false/null (MOD-7266)
• RedisJSON/RedisJSON#1600 Improve RDB load robustness
• RedisTimeSeries/RedisTimeSeries#2067 TS.INFO - inaccurate memory usage calculation (MOD-6409)
• RedisTimeSeries/RedisTimeSeries#2036, RedisTimeSeries/RedisTimeSeries#2053, RedisTimeSeries/RedisTimeSeries#2056, #2074 Aggregation fixes (MOD-8187, MOD-16224, MOD-15565)
• RedisTimeSeries/RedisTimeSeries#2004, RedisTimeSeries/RedisTimeSeries#2051 Improve RDB load robustness
• RedisTimeSeries/RedisTimeSeries#2104 Issues after cluster topology changes
• RedisTimeSeries/RedisTimeSeries#2122 Error on the first cross-shard command (TLS)
• RedisTimeSeries/RedisTimeSeries#2109 TS.INCRBY with TIMESTAMP * replication timestamp drift
• RedisBloom/RedisBloom#1014 CF.LOADCHUNK partial replication (MOD-16050)
• RedisBloom/RedisBloom#1026, RedisBloom/RedisBloom#1027 Improve RDB load robustness

Performance and resource utilization improvements (compared to 8.8.0)

• #15376 Optimize lpSeek() by validating entries only when necessary
• #15345 Optimize wide HSET/HMSET on a fresh hash with a single batched listpack append
• #15330 Avoid recomputing allocator fragmentation twice per cron tick (RED-200844)
• #15259 Trim excess SDS allocation in inline command parsing
• #15256 rax memory reduction: leaf-inlining for fixed-length-key trees - improves XREADGROUP performance
• #15397 Improve RESTORE REPLACE performance for new keys
• #14704 Optimizes an internal memory accounting
• RediSearch/RediSearch#10246 Write operations block on a read lock held throughout vector range query result collection (MOD-16437)
• RediSearch/RediSearch#10392 Vector search: Reduce HNSW index memory usage with one-byte per-node locks (MOD-16696).
• RedisJSON/RedisJSON#1617 JSON - memory object footprint improvements (MOD-16608)

Modules API

• #15350 RedisModuleEvent_ClusterTopologyChange - cluster topology change
• #15327 REDISMODULE_SUBEVENT_FORK_CHILD_* - allow multi-threaded modules can quiesce background work before fork()
• #15373 REDISMODULE_SUBEVENT_CLUSTER_SLOT_MIGRATION_MIGRATE_MODULE_PROPAGATE_END - inject commands after ASM replication stream
• #15242 RedisModule_AddPostNotificationJobForKey - binds deferred work to a specific key from a keyspace-notification handler

Configuration parameters

• #15364 Compact hashes:
  • hash-rdb-load-min-template-entries - minimum field count to convert a plain hash to a template during load
  • hash-rdb-load-max-template-entries - maximum field count for load-time conversion
  • hash-rdb-load-template-disassembly-threshold - minimum number of keys a converted template must end up with to be kept

Metrics

• #15364 Compact hashes:
  • INFO STATS - hash_templates - number of distinct compact hash templates
  • INFO STATS - hash_template_keys - total number of keys backed by a compact hash template
  • INFO MEMORY - used_memory_hash_templates - total memory used by all compact hash templates
  • MEMORY STATS - hash.templates - total memory used by all compact hash templates
  • MEMORY USAGE <key> reports the key’s own + plus its share of a compact hash template cost

CLI tools

• #15352 Adds --latency-percentiles <p1,p2,...> to --latency / --latency-history: reporting user-chosen percentiles
• #15262 redis-cli --cluster rebalance - CROSSSLOT error on when using -user without -a
• #15338 redis-cli --cluster reshard and rebalance now move slots with server-side atomic slot migration