Redis: Security Patches Roll Backward Across Four Release Lines
A single security fix package covering a Vector Sets parser crash and an ACL bypass in MULTI/EXEC is being backported across four release branches, while separate fixes address a redis-cli metadata bug and a test-only race condition.
Duration: PT2M50S
Episode overview
This episode is a short developer briefing from Redis.
It explains recent repository work in plain language.
- Show: Redis
- Published: 2026-09-16T13:14:42Z
- Audio duration: PT2M50S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day, and welcome to Redis, the daily developer briefing for September 16th, 2026.
Today's top story is a coordinated security backport. The same two fixes are landing in pull requests fifteen-eight-hundred through fifteen-eight-oh-four, targeting the 8.2, 8.4, 8.6, 8.8, and 8.10 release lines, all opened within minutes of each other by sundb.
The first fix closes a denial-of-service path in Vector Sets: the fastjson parser allowed unbounded recursion, so a deeply nested JSON array in a filter expression could exhaust the stack and crash the server. The second, tracked as issue fifteen-six-seventy-three, is more serious — an ACL bypass. When commands were…
Second theme: cleanup and correctness in expiration logic. PR fifteen-seven-twenty-five, merged by moticless, strips out the EB_BUCKET_KEY_PRECISION machinery from ebuckets — dead code that's been inert since the feature was introduced, including paths marked "unreachable" and three permanently skipped tests. More…
Smaller items worth noting: PR fifteen-eight-oh-seven fixes redis-cli failing to reload command metadata after a manual AUTH, and PR fifteen-eight-oh-five patches a race in the AOF duration test module where…
What's…
Nearby episodes from Redis
- Trust Boundaries Get Tighter
- Checksum Performance and a Version Bump Cluster
- Weekly Recap - Correctness Fixes and Read-Path Performance
- Hardening Under Concurrency
- Hardening Persistence and Trimming Clock Overhead
- Shaving Branch Misses Out of SipHash
- Correctness Fixes in Replication and Diagnostics
- Correctness Fixes and Core Refactors Converge