Redis: Six Releases, One Security Sweep
Redis shipped six coordinated point releases patching a heap out-of-bounds write, a TLS use-after-free, an ACL key-permission bypass, and a critical RDB-loading remote code execution path, while separately fixing a longstanding cluster failover bug that could strand replicas.
Duration: PT2M56S
Episode overview
This episode is a short developer briefing from Redis.
It explains recent repository work in plain language.
- Show: Redis
- Published: 2026-08-18T13:13:19Z
- Audio duration: PT2M56S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
This is Redis, your development briefing for August 18th, 2026.
Today's headline is a coordinated security release. Six version branches, from 7.4 up through 8.10, all shipped the same batch of fixes within hours of each other, led by sundb across PRs 15659 through 15664 and 15669.
The most serious issue is a malicious RDB payload that could exploit an out-of-range slot info identifier during loading, corrupting memory badly enough to enable remote code execution. Commit 5b9b166 closes that by validating the slot ID range before it's trusted. Alongside it, two Vector Set bugs landed: a…
Two more fixes round out the batch: a TLS pending-data list use-after-free triggered when one client's CLIENT KILL command closed another pending connection mid-iteration, fixed in commit d711b06, and an ACL key-permission bypass affecting SORT, GEORADIUS, and XREAD family commands, where the keys Redis validated…
Separately, there's a notable cluster reliability fix. PR 15530 addresses a failover bug where a replica could get stuck following a demoted master instead of the new one, effectively going dark until manually corrected. The root cause was a race in gossip ordering, and the fix reruns the…
Als…
Nearby episodes from Redis
- Correctness Bugs Sweep Across Core Commands
- TLS Hardening Takes Center Stage
- Streams Get Visibility, Filters Get Fixed
- Boundary Bugs and Cluster Ownership Cleanup
- Security Patch Wave Across Every Supported Branch
- Weekly Recap - A Coordinated Security Push and Deep Data-Structure Rework
- Guarding the Edges of Memory and Math
- Correctness Fixes for Edge Cases