Skip to content

redis

v8.6.5 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 3d Caching
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

cache database distributed-systems in-memory in-memory-database json
+11 more
key-value key-value-store messaging no-sql nosql real-time realtime redis time-series vector-databases vector-db

Affected surfaces

rce_ssrf

Summary

AI summary

Crafted stream RESTORE payloads can cause a use‑after‑free leading to remote code execution.

Full changelog

SECURITY: There are security fixes in the release.

Security fixes

  • A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
  • RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

  • RedisBloom/RedisBloom#1021 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

Security Fixes

  • CVE-2024-XXXXX — crafted stream RESTORE payload causes use‑after‑free and remote code execution
  • dep: CVE-2024-YYYYY — RedisBloom/TDigest crafted RESTORE payloads cause out‑of‑bounds writes leading to remote code execution
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track redis

Get notified when new releases ship.

Sign up free

About redis

For developers, who are building real-time data-driven applications, Redis is the preferred, fastest, and most feature-rich cache, data structure server, and document and vector query engine.

All releases →

Related context

Beta — feedback welcome: [email protected]