Redis 7.4.11 release notes

Redis 7.4.11

7.4.11Aug 17, 2026 · about 11 hours ago

Security 5

Fix use-after-free in the TLS pending-data list when a command closes another pending connection
Fix ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP where validated keys could differ from actually accessed keys
Fix out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command with wrong arity
Fix memory corruption during RDB loading from malicious payload with out-of-range SLOT_INFO slot id that may lead to Remote Code Execution
Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

From Redis

Update urgency: SECURITY: There are security fixes in the release.

Use-after-free in the TLS pending-data list when a command closes another pending connection
#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
#14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Redis 7.4.11