# Redis: what changed from 7 to 8

- Product: Redis (https://whatsnew.fyi/product/redis)
- Vendor: Redis
- Range: changelog entries numbered after 7.4.11 up to and including 8.10.1, stable releases only
- Entries below: 10 releases (newest first)
- Resolved: 7 is 7.4.11 and 8 is 8.10.1, the newest stable release of each major we track
- Carrying security changes: 9 · CVEs mentioned: 1 · Mentioning breaking changes: 0 · Removing or deprecating something: 0
- Page: https://whatsnew.fyi/product/redis/compare/7...8

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (52 changes, grouped by kind)

### Added

#### 8.10.0 (2026-07-29)

- Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
- New command: HIMPORT - high-throughput compact hash bulk insertion
- TLS peer certificate-based server-to-server authentication
- New commands: LMOVEM, BLMOVEM - move multiple elements between lists
- New command: SUNIONCARD - get the cardinality of the union of multiple sets
- New command: SDIFFCARD - get the cardinality of the difference between sets
- New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF
- XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
- New command: FT.ALIASLIST - get all aliases for the index
- Stemmer support for Malay and Tagalog languages
- JSONPath extensions
- New commands: TS.NRANGE, TS.NREVRANGE - query a range across multiple time series; group results by timestamp
- New command: TS.READ - optionally blocking read
- New command: TS.QUERYLABELS - get a list of labels and label-values
- TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples

### Fixed

#### 8.10.0 (2026-07-29)

- Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
- Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
- Memory usage reported for compressed replication clients could be lower than the actual memory consumed
- Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
- FT.CREATE and FT.ALTER now reject an empty string as a field name

#### 8.6.5 (2026-07-23)

- Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover (also in 8.4.5; 8.2.8)

### Security

#### 8.10.1 (2026-08-17)

- Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356) (also in 8.8.2; 8.6.6; 8.4.6; 8.2.9)
- Fix out-of-bounds access in TopK heap cleanup path (also in 8.4.6; 8.2.9)
- Fix use-after-free in the TLS pending-data list when a command closes another pending connection (also in 8.8.2; 8.6.6; 8.4.6; 8.2.9)
- Fix memory corruption during RDB loading when a malicious payload contains an out-of-range SLOT_INFO slot id
- Fix missing node level validation when loading a vector set from RDB that may lead to out-of-bounds access (also in 8.4.6; 8.2.9)
- Fix use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
- Fix negative hnsw_search() return treated as huge unsigned count reading past the end of result arrays
- Fix TLS client certificate authentication bypass where a Common Name containing an embedded NUL byte was truncated
- Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key (also in 8.6.6; 8.4.6; 8.2.9)

#### 8.8.2 (2026-08-17)

- Fix out-of-bounds access in TopK heap cleanup path (MOD-15410) (also in 8.6.6)
- Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP commands where validated keys could differ from actually accessed keys
- Fix memory corruption during RDB loading from malicious payload with out-of-range SLOT_INFO slot id that may lead to Remote Code Execution (also in 8.2.9)
- Fix missing node level validation in Vector Sets when loading from RDB that may lead to out-of-bounds access
- Fix use-after-free in Vector Sets when VREM mutates the HNSW graph while background VSIM threads are still running
- Fix Vector Sets negative hnsw_search() return treated as huge unsigned count, reading past the end of result arrays (also in 8.6.6; 8.2.9)
- Fix TLS client certificate authentication bypass where Common Name containing embedded NUL byte was truncated, allowing client to authenticate as another ACL user (also in 8.6.6)
- Fix use-after-free in blocked-client list when reprocessing a command evicts another client blocked on the same key

#### 8.6.6 (2026-08-17)

- Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP where validated keys could differ from actually accessed keys
- Fix memory corruption during RDB loading caused by out-of-range SLOT_INFO slot id that may lead to Remote Code Execution (also in 8.4.6)
- Fix Vector Sets missing node level validation when loading from RDB that may lead to out-of-bounds access
- Fix Vector Sets use-after-free when VREM mutates the HNSW graph while background VSIM threads are running

#### 8.4.6 (2026-08-17)

- Fix ACL key permission bypass in SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD, and XREADGROUP commands
- Fix out-of-bounds argv access during key extraction when checking ACL permissions of KEYNUM keyspec commands with wrong arity (also in 8.2.9)
- Fix use-after-free in Vector Sets when VREM mutates the HNSW graph while background VSIM threads are running (also in 8.2.9)
- Fix negative hnsw_search() return being treated as huge unsigned count, reading past the end of result arrays in Vector Sets

#### 8.2.9 (2026-08-17)

- Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP commands

#### 8.8.1 (2026-07-23)

- Fixed crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution

#### 8.6.5 (2026-07-23)

- Fix a crafted stream RESTORE payload that could make two consumers share the same NACK, leading to a use-after-free and potential Remote Code Execution
- Fix crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution (also in 8.4.5; 8.2.8)

#### 8.4.5 (2026-07-23)

- Fix a crafted stream RESTORE payload vulnerability that could make two consumers share the same NACK, leading to a use-after-free and potential Remote Code Execution

#### 8.2.8 (2026-07-23)

- Fix a crafted stream RESTORE payload that could make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

## Release notes

### 8.10.1

- Date: 2026-08-17
- Version: 8.10.1
- Original notes: https://github.com/redis/redis/releases/tag/8.10.1
- Permalink: https://whatsnew.fyi/product/redis/releases/8.10.1

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix memory corruption during RDB loading when a malicious payload contains an out-of-range SLOT_INFO slot id
- **security** — Fix missing node level validation when loading a vector set from RDB that may lead to out-of-bounds access
- **security** — Fix use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
- **security** — Fix negative hnsw_search() return treated as huge unsigned count reading past the end of result arrays
- **security** — Fix TLS client certificate authentication bypass where a Common Name containing an embedded NUL byte was truncated
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 8.8.2

- Date: 2026-08-17
- Version: 8.8.2
- Original notes: https://github.com/redis/redis/releases/tag/8.8.2
- Permalink: https://whatsnew.fyi/product/redis/releases/8.8.2

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path (MOD-15410)
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP commands where validated keys could differ from actually accessed keys
- **security** — Fix memory corruption during RDB loading from malicious payload with out-of-range SLOT_INFO slot id that may lead to Remote Code Execution
- **security** — Fix missing node level validation in Vector Sets when loading from RDB that may lead to out-of-bounds access
- **security** — Fix use-after-free in Vector Sets when VREM mutates the HNSW graph while background VSIM threads are still running
- **security** — Fix Vector Sets negative hnsw_search() return treated as huge unsigned count, reading past the end of result arrays
- **security** — Fix TLS client certificate authentication bypass where Common Name containing embedded NUL byte was truncated, allowing client to authenticate as another ACL user
- **security** — Fix use-after-free in blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 8.6.6

- Date: 2026-08-17
- Version: 8.6.6
- Original notes: https://github.com/redis/redis/releases/tag/8.6.6
- Permalink: https://whatsnew.fyi/product/redis/releases/8.6.6

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path (MOD-15410)
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP where validated keys could differ from actually accessed keys
- **security** — Fix memory corruption during RDB loading caused by out-of-range SLOT_INFO slot id that may lead to Remote Code Execution
- **security** — Fix Vector Sets missing node level validation when loading from RDB that may lead to out-of-bounds access
- **security** — Fix Vector Sets use-after-free when VREM mutates the HNSW graph while background VSIM threads are running
- **security** — Fix Vector Sets negative hnsw_search() return treated as huge unsigned count, reading past the end of result arrays
- **security** — Fix TLS client certificate authentication bypass where Common Name containing embedded NUL byte was truncated, allowing client to authenticate as another ACL user
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 8.4.6

- Date: 2026-08-17
- Version: 8.4.6
- Original notes: https://github.com/redis/redis/releases/tag/8.4.6
- Permalink: https://whatsnew.fyi/product/redis/releases/8.4.6

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD, and XREADGROUP commands
- **security** — Fix out-of-bounds argv access during key extraction when checking ACL permissions of KEYNUM keyspec commands with wrong arity
- **security** — Fix memory corruption during RDB loading caused by out-of-range SLOT_INFO slot id that may lead to Remote Code Execution
- **security** — Fix missing node level validation when loading a vector set from RDB that may lead to out-of-bounds access
- **security** — Fix use-after-free in Vector Sets when VREM mutates the HNSW graph while background VSIM threads are running
- **security** — Fix negative hnsw_search() return being treated as huge unsigned count, reading past the end of result arrays in Vector Sets
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- #14847 Out-of-bounds `argv` access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. `EVAL`) with wrong arity
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 8.2.9

- Date: 2026-08-17
- Version: 8.2.9
- Original notes: https://github.com/redis/redis/releases/tag/8.2.9
- Permalink: https://whatsnew.fyi/product/redis/releases/8.2.9

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP commands
- **security** — Fix out-of-bounds argv access during key extraction when checking ACL permissions of KEYNUM keyspec commands with wrong arity
- **security** — Fix memory corruption during RDB loading from malicious payload with out-of-range SLOT_INFO slot id that may lead to remote code execution
- **security** — Fix missing node level validation when loading a vector set from RDB that may lead to out-of-bounds access
- **security** — Fix use-after-free in Vector Sets when VREM mutates the HNSW graph while background VSIM threads are running
- **security** — Fix Vector Sets negative hnsw_search() return treated as huge unsigned count, reading past the end of result arrays
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- #14847 Out-of-bounds `argv` access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. `EVAL`) with wrong arity
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 8.10.0

- Date: 2026-07-29
- Version: 8.10.0
- Original notes: https://github.com/redis/redis/releases/tag/8.10.0
- Permalink: https://whatsnew.fyi/product/redis/releases/8.10.0

- **added** — Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
- **added** — New command: HIMPORT - high-throughput compact hash bulk insertion
- **added** — TLS peer certificate-based server-to-server authentication
- **added** — New commands: LMOVEM, BLMOVEM - move multiple elements between lists
- **added** — New command: SUNIONCARD - get the cardinality of the union of multiple sets
- **added** — New command: SDIFFCARD - get the cardinality of the difference between sets
- **added** — New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF
- **added** — XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
- **added** — New command: FT.ALIASLIST - get all aliases for the index
- **added** — Stemmer support for Malay and Tagalog languages
- **added** — JSONPath extensions
- **added** — New commands: TS.NRANGE, TS.NREVRANGE - query a range across multiple time series; group results by timestamp
- **added** — New command: TS.READ - optionally blocking read
- **added** — New command: TS.QUERYLABELS - get a list of labels and label-values
- **added** — TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
- **fixed** — Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
- **fixed** — Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
- **fixed** — Memory usage reported for compressed replication clients could be lower than the actual memory consumed
- **fixed** — Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
- **fixed** — FT.CREATE and FT.ALTER now reject an empty string as a field name

This is the General Availability release of Redis 8.10 in Redis Open Source.

###### Major changes compared to 8.8

- Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
- New command: `HIMPORT` - high-throughput compact hash bulk insertion
- TLS peer certificate-based server-to-server authentication
- New commands: `LMOVEM`, `BLMOVEM` - move multiple elements between lists
- New command: `SUNIONCARD` - get the cardinality of the union of multiple sets
- New command: `SDIFFCARD` - get the cardinality of the difference between sets
- New command: `BACKUP` - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
- `XREAD`, `XREADGROUP` - new `MAXCOUNT` and `MAXSIZE` arguments to cap the cumulative reply entries and size
- New command: `FT.ALIASLIST` - get all aliases for the index 
- Stemmer support for Malay and Tagalog languages 
- JSONPath extensions
- New commands: `TS.NRANGE`, `TS.NREVRANGE` - Query a range across multiple time series; group results by timestamp 
- New command: `TS.READ` - optionally blocking read
- New command: `TS.QUERYLABELS` - Get a list of labels and label-values 
- New command: `TS.MRANGE`, `TS.MREVRANGE` - new `EXCLUDEEMPTY` argument to exclude series with no reported samples 
- Performance improvements 

###### Binary distributions

- Alpine and Debian Docker images - https://hub.docker.com/_/redis
- Install using snap - see https://github.com/redis/redis-snap
- Install using brew - see https://github.com/redis/homebrew-redis
- Install using RPM - see https://github.com/redis/redis-rpm
- Install using Debian APT - see https://github.com/redis/redis-debian


###### Operating systems we test Redis 8.10 on

- Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
- Rocky Linux 8.10, 9.7, 10.1
- AlmaLinux 8.10, 9.7, 10.1
- Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
- Alpine 3.23
- macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

###### Bug fixes (compared to 8.10-RC2)

- #15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
- #15453 Clients blocked on `BLPOP`, `BLMOVE`, or `BLMOVEM` could remain blocked after `SORT` with `STORE` replaced the target key with a list
- #15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed
- #15518 notify modules when node's own ip/port changes
- #15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
- RediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)
- RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)
- RediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)
- RediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)
- RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)
- RediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)

### 8.8.1

- Date: 2026-07-23
- Version: 8.8.1
- Original notes: https://github.com/redis/redis/releases/tag/8.8.1
- Permalink: https://whatsnew.fyi/product/redis/releases/8.8.1

- **security** — Fixed crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution

SECURITY: There is a security fix in the release.

###### Security fixes

- RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

### 8.6.5

- Date: 2026-07-23
- Version: 8.6.5
- Original notes: https://github.com/redis/redis/releases/tag/8.6.5
- Permalink: https://whatsnew.fyi/product/redis/releases/8.6.5

- **security** — Fix a crafted stream RESTORE payload that could make two consumers share the same NACK, leading to a use-after-free and potential Remote Code Execution
- **security** — Fix crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution
- **fixed** — Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

###### Security fixes

- A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
- RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

###### Bug fixes

- RedisBloom/RedisBloom#1021 Replicate `CF.LOADCHUNK` data chunks to prevent silent Cuckoo Filter data loss on failover

### 8.4.5

- Date: 2026-07-23
- Version: 8.4.5
- Original notes: https://github.com/redis/redis/releases/tag/8.4.5
- Permalink: https://whatsnew.fyi/product/redis/releases/8.4.5

- **security** — Fix a crafted stream RESTORE payload vulnerability that could make two consumers share the same NACK, leading to a use-after-free and potential Remote Code Execution
- **security** — Fix crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution
- **fixed** — Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

###### Security fixes

- A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
- RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

###### Bug fixes

- RedisBloom/RedisBloom#1020 Replicate `CF.LOADCHUNK` data chunks to prevent silent Cuckoo Filter data loss on failover

### 8.2.8

- Date: 2026-07-23
- Version: 8.2.8
- Original notes: https://github.com/redis/redis/releases/tag/8.2.8
- Permalink: https://whatsnew.fyi/product/redis/releases/8.2.8

- **security** — Fix a crafted stream RESTORE payload that could make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
- **security** — Fix crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution
- **fixed** — Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

###### Security fixes

- A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
- RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

###### Bug fixes

- RedisBloom/RedisBloom#1019 Replicate `CF.LOADCHUNK` data chunks to prevent silent Cuckoo Filter data loss on failover