# Redis changelog

> In-memory data store used as a database, cache, and message broker.

- Vendor: Redis
- Category: Databases & Data
- Language: C
- Official site: https://redis.io
- Tracked by: What's New (https://whatsnew.fyi/product/redis)
- Harvested from: GitHub (redis/redis)
- Entries below: 23 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 8.10.2

- Date: 2026-09-17
- Version: 8.10.2
- Original notes: https://github.com/redis/redis/releases/tag/8.10.2
- Permalink: https://whatsnew.fyi/product/redis/releases/8.10.2

- **security** — Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- **security** — The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it; a cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice
- **fixed** — Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- **fixed** — KNN queries on indexes with very long vector field names could cause the server to crash
- **fixed** — Deeply nested JSON used in Vector Set queries could cause the server to crash

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- #15722 The cluster bus protocol has no authentication of its own unless `tls-cluster` is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new `cluster-bus-port-protected-mode` option (default `no`) makes refusing to run in that state an explicit choice: set it to `yes` and the node starts only when `tls-cluster` authenticates the bus
- TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- RedisSearch: KNN queries on indexes with very long vector field names could cause the server to crash
- Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

### 8.8.3

- Date: 2026-09-17
- Version: 8.8.3
- Original notes: https://github.com/redis/redis/releases/tag/8.8.3
- Permalink: https://whatsnew.fyi/product/redis/releases/8.8.3

- **security** — Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- **security** — The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it; a cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice by setting it to yes and the node starts only when tls-cluster authenticates the bus
- **fixed** — Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- **fixed** — Deeply nested JSON used in Vector Set queries could cause the server to crash

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- #15722 The cluster bus protocol has no authentication of its own unless `tls-cluster` is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new `cluster-bus-port-protected-mode` option (default `no`) makes refusing to run in that state an explicit choice: set it to `yes` and the node starts only when `tls-cluster` authenticates the bus
- TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

### 8.6.7

- Date: 2026-09-17
- Version: 8.6.7
- Original notes: https://github.com/redis/redis/releases/tag/8.6.7
- Permalink: https://whatsnew.fyi/product/redis/releases/8.6.7

- **security** — Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- **security** — The cluster bus protocol now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice
- **fixed** — Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- **fixed** — Deeply nested JSON used in Vector Set queries could cause the server to crash

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- #15722 The cluster bus protocol has no authentication of its own unless `tls-cluster` is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new `cluster-bus-port-protected-mode` option (default `no`) makes refusing to run in that state an explicit choice: set it to `yes` and the node starts only when `tls-cluster` authenticates the bus
- TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

### 8.4.7

- Date: 2026-09-17
- Version: 8.4.7
- Original notes: https://github.com/redis/redis/releases/tag/8.4.7
- Permalink: https://whatsnew.fyi/product/redis/releases/8.4.7

- **security** — Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- **security** — The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it; a cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice
- **fixed** — Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- **fixed** — Deeply nested JSON used in Vector Set queries could cause the server to crash

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
- #15722 The cluster bus protocol has no authentication of its own unless `tls-cluster` is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new `cluster-bus-port-protected-mode` option (default `no`) makes refusing to run in that state an explicit choice: set it to `yes` and the node starts only when `tls-cluster` authenticates the bus
- TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

### 8.2.10

- Date: 2026-09-17
- Version: 8.2.10
- Original notes: https://github.com/redis/redis/releases/tag/8.2.10
- Permalink: https://whatsnew.fyi/product/redis/releases/8.2.10

- **security** — Add cluster-bus-port-protected-mode option to require TLS authentication on cluster bus port and warn at startup when bus port is left unauthenticated
- **fixed** — Prevent Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- **fixed** — Prevent server crash from deeply nested JSON used in Vector Set queries

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- #15722 The cluster bus protocol has no authentication of its own unless `tls-cluster` is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new `cluster-bus-port-protected-mode` option (default `no`) makes refusing to run in that state an explicit choice: set it to `yes` and the node starts only when `tls-cluster` authenticates the bus
- TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
- Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

### 8.10.1

- Date: 2026-08-17
- Version: 8.10.1
- Original notes: https://github.com/redis/redis/releases/tag/8.10.1
- Permalink: https://whatsnew.fyi/product/redis/releases/8.10.1

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix memory corruption during RDB loading when a malicious payload contains an out-of-range SLOT_INFO slot id
- **security** — Fix missing node level validation when loading a vector set from RDB that may lead to out-of-bounds access
- **security** — Fix use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
- **security** — Fix negative hnsw_search() return treated as huge unsigned count reading past the end of result arrays
- **security** — Fix TLS client certificate authentication bypass where a Common Name containing an embedded NUL byte was truncated
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 8.8.2

- Date: 2026-08-17
- Version: 8.8.2
- Original notes: https://github.com/redis/redis/releases/tag/8.8.2
- Permalink: https://whatsnew.fyi/product/redis/releases/8.8.2

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path (MOD-15410)
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP commands where validated keys could differ from actually accessed keys
- **security** — Fix memory corruption during RDB loading from malicious payload with out-of-range SLOT_INFO slot id that may lead to Remote Code Execution
- **security** — Fix missing node level validation in Vector Sets when loading from RDB that may lead to out-of-bounds access
- **security** — Fix use-after-free in Vector Sets when VREM mutates the HNSW graph while background VSIM threads are still running
- **security** — Fix Vector Sets negative hnsw_search() return treated as huge unsigned count, reading past the end of result arrays
- **security** — Fix TLS client certificate authentication bypass where Common Name containing embedded NUL byte was truncated, allowing client to authenticate as another ACL user
- **security** — Fix use-after-free in blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 8.6.6

- Date: 2026-08-17
- Version: 8.6.6
- Original notes: https://github.com/redis/redis/releases/tag/8.6.6
- Permalink: https://whatsnew.fyi/product/redis/releases/8.6.6

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path (MOD-15410)
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP where validated keys could differ from actually accessed keys
- **security** — Fix memory corruption during RDB loading caused by out-of-range SLOT_INFO slot id that may lead to Remote Code Execution
- **security** — Fix Vector Sets missing node level validation when loading from RDB that may lead to out-of-bounds access
- **security** — Fix Vector Sets use-after-free when VREM mutates the HNSW graph while background VSIM threads are running
- **security** — Fix Vector Sets negative hnsw_search() return treated as huge unsigned count, reading past the end of result arrays
- **security** — Fix TLS client certificate authentication bypass where Common Name containing embedded NUL byte was truncated, allowing client to authenticate as another ACL user
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 8.4.6

- Date: 2026-08-17
- Version: 8.4.6
- Original notes: https://github.com/redis/redis/releases/tag/8.4.6
- Permalink: https://whatsnew.fyi/product/redis/releases/8.4.6

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD, and XREADGROUP commands
- **security** — Fix out-of-bounds argv access during key extraction when checking ACL permissions of KEYNUM keyspec commands with wrong arity
- **security** — Fix memory corruption during RDB loading caused by out-of-range SLOT_INFO slot id that may lead to Remote Code Execution
- **security** — Fix missing node level validation when loading a vector set from RDB that may lead to out-of-bounds access
- **security** — Fix use-after-free in Vector Sets when VREM mutates the HNSW graph while background VSIM threads are running
- **security** — Fix negative hnsw_search() return being treated as huge unsigned count, reading past the end of result arrays in Vector Sets
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- #14847 Out-of-bounds `argv` access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. `EVAL`) with wrong arity
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 8.2.9

- Date: 2026-08-17
- Version: 8.2.9
- Original notes: https://github.com/redis/redis/releases/tag/8.2.9
- Permalink: https://whatsnew.fyi/product/redis/releases/8.2.9

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP commands
- **security** — Fix out-of-bounds argv access during key extraction when checking ACL permissions of KEYNUM keyspec commands with wrong arity
- **security** — Fix memory corruption during RDB loading from malicious payload with out-of-range SLOT_INFO slot id that may lead to remote code execution
- **security** — Fix missing node level validation when loading a vector set from RDB that may lead to out-of-bounds access
- **security** — Fix use-after-free in Vector Sets when VREM mutates the HNSW graph while background VSIM threads are running
- **security** — Fix Vector Sets negative hnsw_search() return treated as huge unsigned count, reading past the end of result arrays
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- #14847 Out-of-bounds `argv` access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. `EVAL`) with wrong arity
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 7.4.11

- Date: 2026-08-17
- Version: 7.4.11
- Original notes: https://github.com/redis/redis/releases/tag/7.4.11
- Permalink: https://whatsnew.fyi/product/redis/releases/7.4.11

- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP where validated keys could differ from actually accessed keys
- **security** — Fix out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command with wrong arity
- **security** — Fix memory corruption during RDB loading from malicious payload with out-of-range SLOT_INFO slot id that may lead to Remote Code Execution
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- Use-after-free in the TLS pending-data list when a command closes another pending connection
- #15478 ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- #14847 Out-of-bounds `argv` access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. `EVAL`) with wrong arity
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 7.2.16

- Date: 2026-08-17
- Version: 7.2.16
- Original notes: https://github.com/redis/redis/releases/tag/7.2.16
- Permalink: https://whatsnew.fyi/product/redis/releases/7.2.16

- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP where validated keys could differ from actually accessed keys
- **security** — Fix out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command with wrong arity
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- Use-after-free in the TLS pending-data list when a command closes another pending connection
- ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses
- Out-of-bounds `argv` access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. `EVAL`) with wrong arity
- Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

### 6.2.24

- Date: 2026-08-17
- Version: 6.2.24
- Original notes: https://github.com/redis/redis/releases/tag/6.2.24
- Permalink: https://whatsnew.fyi/product/redis/releases/6.2.24

- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection

Update urgency: `SECURITY`: There is a security fix in the release.

###### Security fixes

- Use-after-free in the TLS pending-data list when a command closes another pending connection

### 8.10.0

- Date: 2026-07-29
- Version: 8.10.0
- Original notes: https://github.com/redis/redis/releases/tag/8.10.0
- Permalink: https://whatsnew.fyi/product/redis/releases/8.10.0

- **added** — Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
- **added** — New command: HIMPORT - high-throughput compact hash bulk insertion
- **added** — TLS peer certificate-based server-to-server authentication
- **added** — New commands: LMOVEM, BLMOVEM - move multiple elements between lists
- **added** — New command: SUNIONCARD - get the cardinality of the union of multiple sets
- **added** — New command: SDIFFCARD - get the cardinality of the difference between sets
- **added** — New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF
- **added** — XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
- **added** — New command: FT.ALIASLIST - get all aliases for the index
- **added** — Stemmer support for Malay and Tagalog languages
- **added** — JSONPath extensions
- **added** — New commands: TS.NRANGE, TS.NREVRANGE - query a range across multiple time series; group results by timestamp
- **added** — New command: TS.READ - optionally blocking read
- **added** — New command: TS.QUERYLABELS - get a list of labels and label-values
- **added** — TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
- **fixed** — Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
- **fixed** — Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
- **fixed** — Memory usage reported for compressed replication clients could be lower than the actual memory consumed
- **fixed** — Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
- **fixed** — FT.CREATE and FT.ALTER now reject an empty string as a field name

This is the General Availability release of Redis 8.10 in Redis Open Source.

###### Major changes compared to 8.8

- Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
- New command: `HIMPORT` - high-throughput compact hash bulk insertion
- TLS peer certificate-based server-to-server authentication
- New commands: `LMOVEM`, `BLMOVEM` - move multiple elements between lists
- New command: `SUNIONCARD` - get the cardinality of the union of multiple sets
- New command: `SDIFFCARD` - get the cardinality of the difference between sets
- New command: `BACKUP` - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
- `XREAD`, `XREADGROUP` - new `MAXCOUNT` and `MAXSIZE` arguments to cap the cumulative reply entries and size
- New command: `FT.ALIASLIST` - get all aliases for the index 
- Stemmer support for Malay and Tagalog languages 
- JSONPath extensions
- New commands: `TS.NRANGE`, `TS.NREVRANGE` - Query a range across multiple time series; group results by timestamp 
- New command: `TS.READ` - optionally blocking read
- New command: `TS.QUERYLABELS` - Get a list of labels and label-values 
- New command: `TS.MRANGE`, `TS.MREVRANGE` - new `EXCLUDEEMPTY` argument to exclude series with no reported samples 
- Performance improvements 

###### Binary distributions

- Alpine and Debian Docker images - https://hub.docker.com/_/redis
- Install using snap - see https://github.com/redis/redis-snap
- Install using brew - see https://github.com/redis/homebrew-redis
- Install using RPM - see https://github.com/redis/redis-rpm
- Install using Debian APT - see https://github.com/redis/redis-debian


###### Operating systems we test Redis 8.10 on

- Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
- Rocky Linux 8.10, 9.7, 10.1
- AlmaLinux 8.10, 9.7, 10.1
- Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
- Alpine 3.23
- macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

###### Bug fixes (compared to 8.10-RC2)

- #15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
- #15453 Clients blocked on `BLPOP`, `BLMOVE`, or `BLMOVEM` could remain blocked after `SORT` with `STORE` replaced the target key with a list
- #15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed
- #15518 notify modules when node's own ip/port changes
- #15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
- RediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)
- RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)
- RediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)
- RediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)
- RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)
- RediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)

### 8.8.1

- Date: 2026-07-23
- Version: 8.8.1
- Original notes: https://github.com/redis/redis/releases/tag/8.8.1
- Permalink: https://whatsnew.fyi/product/redis/releases/8.8.1

- **security** — Fixed crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution

SECURITY: There is a security fix in the release.

###### Security fixes

- RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

### 8.6.5

- Date: 2026-07-23
- Version: 8.6.5
- Original notes: https://github.com/redis/redis/releases/tag/8.6.5
- Permalink: https://whatsnew.fyi/product/redis/releases/8.6.5

- **security** — Fix a crafted stream RESTORE payload that could make two consumers share the same NACK, leading to a use-after-free and potential Remote Code Execution
- **security** — Fix crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution
- **fixed** — Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

###### Security fixes

- A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
- RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

###### Bug fixes

- RedisBloom/RedisBloom#1021 Replicate `CF.LOADCHUNK` data chunks to prevent silent Cuckoo Filter data loss on failover

### 8.4.5

- Date: 2026-07-23
- Version: 8.4.5
- Original notes: https://github.com/redis/redis/releases/tag/8.4.5
- Permalink: https://whatsnew.fyi/product/redis/releases/8.4.5

- **security** — Fix a crafted stream RESTORE payload vulnerability that could make two consumers share the same NACK, leading to a use-after-free and potential Remote Code Execution
- **security** — Fix crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution
- **fixed** — Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

###### Security fixes

- A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
- RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

###### Bug fixes

- RedisBloom/RedisBloom#1020 Replicate `CF.LOADCHUNK` data chunks to prevent silent Cuckoo Filter data loss on failover

### 8.2.8

- Date: 2026-07-23
- Version: 8.2.8
- Original notes: https://github.com/redis/redis/releases/tag/8.2.8
- Permalink: https://whatsnew.fyi/product/redis/releases/8.2.8

- **security** — Fix a crafted stream RESTORE payload that could make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
- **security** — Fix crafted RESTORE payloads in RedisBloom and TDigest that may trigger out-of-bounds writes, potentially leading to remote code execution
- **fixed** — Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

###### Security fixes

- A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
- RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

###### Bug fixes

- RedisBloom/RedisBloom#1019 Replicate `CF.LOADCHUNK` data chunks to prevent silent Cuckoo Filter data loss on failover

### 7.4.10

- Date: 2026-07-23
- Version: 7.4.10
- Original notes: https://github.com/redis/redis/releases/tag/7.4.10
- Permalink: https://whatsnew.fyi/product/redis/releases/7.4.10

- **security** — Fix a use-after-free vulnerability in stream RESTORE that could result in Remote Code Execution when a crafted payload causes two consumers to share the same NACK

Update urgency: `SECURITY`: There is a security fix in the release.

###### Security fixes

- A crafted stream `RESTORE` payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

### 7.2.15

- Date: 2026-07-23
- Version: 7.2.15
- Original notes: https://github.com/redis/redis/releases/tag/7.2.15
- Permalink: https://whatsnew.fyi/product/redis/releases/7.2.15

- **security** — Fix a crafted stream RESTORE payload vulnerability that could cause two consumers to share the same NACK, leading to a use-after-free that may result in Remote Code Execution

Update urgency: `SECURITY`: There is a security fix in the release.

###### Security fixes

- A crafted stream `RESTORE` payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

### 6.2.23

- Date: 2026-07-23
- Version: 6.2.23
- Original notes: https://github.com/redis/redis/releases/tag/6.2.23
- Permalink: https://whatsnew.fyi/product/redis/releases/6.2.23

- **security** — Fix a crafted stream RESTORE payload vulnerability that could make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

Update urgency: `SECURITY`: There is a security fix in the release.

###### Security fixes

- A crafted stream `RESTORE` payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

### 8.10-rc2 — 8.10-RC2

- Date: 2026-07-20
- Version: 8.10-rc2
- Original notes: https://github.com/redis/redis/releases/tag/8.10-rc2
- Permalink: https://whatsnew.fyi/product/redis/releases/8.10-rc2
- Labels: Pre-release

- **fixed** — A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
- **fixed** — A typo in release.h that could cause build failures

This is the second Release Candidate of Redis 8.10 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

###### Bug fixes (compared to 8.10-RC1)

- A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
- A typo in release.h that could cause build failures

### 8.10-rc1 — 8.10-RC1

- Date: 2026-07-20
- Version: 8.10-rc1
- Original notes: https://github.com/redis/redis/releases/tag/8.10-rc1
- Permalink: https://whatsnew.fyi/product/redis/releases/8.10-rc1
- Labels: Pre-release

- **added** — Compact hashes encoding that reduces memory usage by storing hash field names just once for keys that share a schema
- **added** — Replication stream compression to reduce bandwidth consumption between primaries and replicas
- **added** — New command HIMPORT for high-throughput compact hash bulk insertion
- **added** — New commands LMOVEM and BLMOVEM to move multiple elements between lists
- **added** — New command SUNIONCARD to get the cardinality of the union of multiple sets
- **added** — New command SDIFFCARD to get the cardinality of the difference between sets
- **added** — New command BACKUP for node-side implementation of backup and restore based on multi-part AOF
- **added** — XREAD and XREADGROUP support new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
- **added** — New SCRIPT_RUNNER command flag for commands that execute scripts or functions
- **added** — SLOWLOG GET now includes total argument count in reply
- **added** — New command FT.ALIASLIST to get all aliases for an index
- **added** — Stemmer support for Malay and Tagalog languages in RediSearch
- **added** — FT.AGGREGATE now supports whole-document fetching using COLLECT, in-group SORTBY/LIMIT, and deduplication control within a single query
- **added** — FT.SEARCH, FT.AGGREGATE, and FT.HYBRID now enforce query TIMEOUT more strictly with FAIL, RETURN, and RETURN_STRICT modes and new search-global-timeout parameter
- **added** — JSONPath extensions including projection expressions, comparison operators for any literal, filter negation operator, size and empty operators, in and nin operators, arithmetic operators, and various functions
- **added** — New commands TS.NRANGE and TS.NREVRANGE to query a range across multiple time series with results grouped by timestamp
- **added** — New command TS.READ for optionally blocking read of time series
- **added** — New command TS.QUERYLABELS to get a list of labels and label-values
- **added** — TS.MRANGE and TS.MREVRANGE support new EXCLUDEEMPTY argument to exclude series with no reported samples
- **fixed** — ACL permission bypass in SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD, and XREADGROUP

This is the first Release Candidate of Redis 8.10 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

###### Headlines:

Redis 8.10 introduces new features and performance improvements.

###### Operating systems we test Redis 8.10 on

- Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
- Rocky Linux 8.10, 9.7, 10.1
- AlmaLinux 8.10, 9.7, 10.1
- Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
- Alpine 3.23
- macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

###### New Features (compared to 8.8)

- #15364 Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
- #15366 Replication stream compression to reduce bandwidth consumption between primaries and replicas
- #15364 New command: `HIMPORT` - high-throughput compact hash bulk insertion
- #15405 New commands: `LMOVEM`, `BLMOVEM` - move multiple elements between lists
- #14893 New command: `SUNIONCARD` - get the cardinality of the union of multiple sets
- #15278 New command: `SDIFFCARD` - get the cardinality of the difference between sets
- #15441 New command: `BACKUP` - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
- #15282 `XREAD`, `XREADGROUP` - new `MAXCOUNT` and `MAXSIZE` arguments to cap the cumulative reply entries and size
- #15337 New `SCRIPT_RUNNER` command flag: flag commands that execute scripts or functions
- #15347 `SLOWLOG GET` - new reply argument: total argument count
- RediSearch/RediSearch#9626 New command: `FT.ALIASLIST` - get all aliases for the index (RED-197340)
- RediSearch/RediSearch#9052 New Languages Search: Stemmer support for Malay and Tagalog languages (RED-132425)
- RediSearch/RediSearch#9291 `FT.AGGREGATE` now supports whole-document fetching using `COLLECT`, in-group SORTBY/LIMIT, and deduplication control within a single query. (RED-177887)
- RediSearch/RediSearch#8169, RediSearch/RediSearch#8236, RediSearch/RediSearch#9234, RediSearch/RediSearch#9443 — `FT.SEARCH`, `FT.AGGREGATE`, `FT.HYBRID`: enforce query `TIMEOUT` more strictly; long-running queries require vertical scaling (multi-threaded execution). (RED-132340)
  - use `FAIL` when correctness requires rejecting timed-out queries. With `search-workers` > 0` (the default), the timeout is enforced preemptively
  - use `RETURN` when best-effort partial results are acceptable and strictness not enforced at post-processing time.
  - use `RETURN_STRICT` when best-effort partial results are acceptable and strictness enforced on post-processing.
  - New parameter `search-global-timeout` acting as cap value to timeout setting on query time TIMEOUT param
- RedisJSON/RedisJSON#1602, RedisJSON/RedisJSON#1603, RedisJSON/RedisJSON#1604, RedisJSON/RedisJSON#1607, RedisJSON/RedisJSON#1618 JSONPath extensions (MOD-16274, MOD-16275):
  - Projection expressions at the top level of a JSONPath query
  - `==` and `!=` can now compare any literal, including array and object literals
  - Filter negation operator: `!`
  - `size`/`sizeof` and `empty` operators on string, array, object, and nodelist
  - `in` and `nin` operators: membership test on an array and nodelist
  - Operators on numbers: binary `-`, `+`, `*`, `/`, `%`, and unary `-` and `+`
  - Operator on object: `~`
  - `length()` function on array, object, and string
  - Functions on number: `abs()`, `ceiling()`, `floor()`
  - Functions on string: `match()`, `search()`
  - Strings concatenation with `concat()`
  - Functions on array: `first()`, `last()`, `index()`, `append()`
  - Aggregation functions on array: `min()`, `max()`, `avg()`, `sum()`, `stddev()`
  - Function on object: `keys()`
  - Function on nodelist: `count()`
  - Function on nodelist with exactly one node: `value()`
  - Relations functions on array and nodelist: `subsetof()`, `anyof()`, `noneof()`
-

_[Truncated at 4000 characters — full notes: https://github.com/redis/redis/releases/tag/8.10-rc1]_