# Redis 8.10.1

- Product: Redis (https://whatsnew.fyi/product/redis)
- Vendor: Redis
- Date: 2026-08-17
- Version: 8.10.1
- Original notes: https://github.com/redis/redis/releases/tag/8.10.1
- Permalink: https://whatsnew.fyi/product/redis/releases/8.10.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix miscalculated buffer size in CMSketch RDB loading that may lead to heap out-of-bounds write (CVE-2026-62356)
- **security** — Fix out-of-bounds access in TopK heap cleanup path
- **security** — Fix use-after-free in the TLS pending-data list when a command closes another pending connection
- **security** — Fix memory corruption during RDB loading when a malicious payload contains an out-of-range SLOT_INFO slot id
- **security** — Fix missing node level validation when loading a vector set from RDB that may lead to out-of-bounds access
- **security** — Fix use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
- **security** — Fix negative hnsw_search() return treated as huge unsigned count reading past the end of result arrays
- **security** — Fix TLS client certificate authentication bypass where a Common Name containing an embedded NUL byte was truncated
- **security** — Fix use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: `SECURITY`: There are security fixes in the release.

###### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write
- Out-of-bounds access in TopK heap cleanup path (MOD-15410)
- Use-after-free in the TLS pending-data list when a command closes another pending connection
- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running
- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays
- TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key