redis

v8.6.4 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Caching

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

cache database distributed-systems in-memory in-memory-database json

+11 more

key-value key-value-store messaging no-sql nosql real-time realtime redis time-series vector-databases vector-db

Affected surfaces

breaking_upgrade rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 1mo

Redis 8.6.4 eliminates a Sentinel configuration injection flaw via the `SENTINEL SET` command and resolves several critical bug fixes affecting startup, memory accounting, transaction handling, and client operations.

Why it matters: The release patches a high‑severity (severity 95) security vulnerability that could allow unauthorized configuration changes; all deployments using Sentinel should upgrade immediately to prevent exploitation.

Summary

AI summary

Updates Bug fixes, regression, and MOD-15542 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Removes Sentinel configuration injection vulnerability via `SENTINEL SET` command Removes Sentinel configuration injection vulnerability via `SENTINEL SET` command Source: llm_adapter@2026-06-04 Confidence: high	—
Performance	High	Eliminates severe latency spikes and unresponsiveness when `EXPIRE`/`EXPIREAT` run concurrently with queries on large indexes Eliminates severe latency spikes and unresponsiveness when `EXPIRE`/`EXPIREAT` run concurrently with queries on large indexes Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix
Bugfix	High	Fixes Redis startup failure on AArch64 architecture Fixes Redis startup failure on AArch64 architecture Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	High	Corrects inaccurate memory accounting for `MULTI` command queues Corrects inaccurate memory accounting for `MULTI` command queues Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	High	Resolves under-copy issue in the Lua debugger Resolves under-copy issue in the Lua debugger Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	High	Prevents cluster crash when `CLIENT KILL` unsubscribes an `SSUBSCRIBE` client inside `EXEC` Prevents cluster crash when `CLIENT KILL` unsubscribes an `SSUBSCRIBE` client inside `EXEC` Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	High	Addresses consumer replication inconsistency in `XREADGROUP` Addresses consumer replication inconsistency in `XREADGROUP` Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	High	Fixes missing memory accounting for copy‑avoided bulk string references in client output buffers Fixes missing memory accounting for copy‑avoided bulk string references in client output buffers Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	High	Prevents integer overflow in the `COUNT` parameter of SCAN commands Prevents integer overflow in the `COUNT` parameter of SCAN commands Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	High	Corrects self‑overlap reporting for `CLIENT TRACKING` returning non‑zero loop index Corrects self‑overlap reporting for `CLIENT TRACKING` returning non‑zero loop index Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	High	Fixes incorrect per‑slot memory tracking value in `XINFO STREAM` output Fixes incorrect per‑slot memory tracking value in `XINFO STREAM` output Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix	High	Resolves potential TCP stalls and deadlocks Resolves potential TCP stalls and deadlocks Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	High	Prevents shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases Prevents shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Medium	Fixes overflow on fields count in `HEXPIRE` command Fixes overflow on fields count in `HEXPIRE` command Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Medium	Allows hostnames in `cluster-announce-ip` configuration (regression fix) Allows hostnames in `cluster-announce-ip` configuration (regression fix) Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Low	Handles corrupt RDB data processing issues Handles corrupt RDB data processing issues Source: granite4.1:30b@2026-06-04-audit Confidence: low	—
Bugfix	Low	Corrects `COMMAND GETKEYS for PFMERGE` behavior when no source keys are present Corrects `COMMAND GETKEYS for PFMERGE` behavior when no source keys are present Source: granite4.1:30b@2026-06-04-audit Confidence: low	—

Full changelog

Update urgency: HIGH: There are critical bugs that may affect a subset of users.

Bug fixes

#15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
#15163 MULTI queue memory incorrect memory accounting
#15115 Under-copy in the Lua debugger
#15094 Cluster crash when CLIENT KILL unsubscribes SSUBSCRIBE client inside EXEC
#14963 XREADGROUP: consumer replication inconsistency
#14934 Client output buffer memory tracking not accounting for copy-avoided bulk string references
#14970 Sentinel config injection via SENTINEL SET
#14982 SCAN commands: integer overflow in COUNT parameter
#15073 CLIENT TRACKING: self-overlap returning non-zero loop index
#15059 Use-after-free
#15037 XINFO STREAM: wrong value in the per-slot memory tracking
#15034, #15081 Issues processing corrupt RDB data
#15021 HEXPIRE: overflow on fields count
#14942 Fix COMMAND GETKEYS for PFMERGE with no source keys
#15188 cluster-announce-ip rejecting hostnames (regression)
#14667, #14886 Potential TCP stalls/deadlocks
RediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
RediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)

Security Fixes

Use‑after‑free vulnerability fixed (#15059)
Sentinel config injection via `SENTINEL SET` patched (#14970)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track redis

Get notified when new releases ship.

About redis

For developers, who are building real-time data-driven applications, Redis is the preferred, fastest, and most feature-rich cache, data structure server, and document and vector query engine.

redis

ReleasePort's take

Summary

Changes in this release

Bug fixes

Security Fixes

Related context

Related tools

Featured in