Fixed a startup failure on AArch64 and a cluster crash when CLIENT KILL unsubscribes an SSUBSCRIBE client inside EXEC. Also resolved a use-after-free, integer overflow in SCAN COUNT parameter, Sentinel config injection via SENTINEL SET, TCP stalls/deadlocks, and numerous other correctness issues in MULTI accounting, Lua debugging, XREADGROUP replication, client output buffer tracking, and RDB processing.
redis
Fixed Redis failing to start on AArch64 and a cluster-announce-ip regression rejecting hostnames. Also resolved ACL rule loading failures during AOF recovery, SCAN filter-order reversion, potential TCP deadlocks, stream trim/add bugs, crash during replica synchronization, and latency spikes on concurrent EXPIRE operations with large indexes.
Fixed Redis failing to start on AArch64 and restored original SCAN filter order (reverted a change from 8.2). Also corrected Streams behavior with XTRIM/XADD approx mode and XDELEX after XGROUP DESTROY, fixed a potential crash in lookupKey() when executing_client is NULL, a heap-buffer-overflow in CLUSTER FORGET, and TCP stalls/deadlocks. RediSearch fixes include a shard crash during background JSON vector index scans on Active-Active databases and latency spikes when EXPIRE operations run concurrently with large index queries.
Redis 8.8.0 introduces a new Array data structure and subkey notifications for hash fields, enabling field-level event notifications. New commands include INCREX (a window counter rate limiter), XNACK (explicit pending message release for streams), and expanded aggregation support across sorted set and search commands, plus performance improvements.
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
- (CVE-2026-23479) Use-After-Free in unblock client flow...
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
- (CVE-2026-23479) Use-After-Free in unblock client flow...
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
- (CVE-2026-23479) Use-After-Free in unblock client flow...
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
- (CVE-2026-23479) Use-After-Free in unblock client flow...
Update urgency: SECURITY: There are security fixes in the release.
Security fixes
- (CVE-2026-23479) Use-After-Free in unblock client flow...
Update urgency: SECURITY: There is a security fix in the release.
Security fixes
- (CVE-2026-25243) Invalid memory access in
RESTOREmay...
This is the third Milestone of Redis 8.8 in Redis Open Source.
Milestones are non-feature-complete pre-releases. Pre-releases are not suitable for ...
This is the second Milestone of Redis 8.8 in Redis Open Source.
Milestones are non-feature-complete pre-releases. Pre-releases are not suitable for...
Bug fixes
- #14824 Potential UAF: don't use reply copy avoidance for module strings
- #14848 Crash during command processing on replicas perfo...
SECURITY: There is a security fix in the release
Security fixes
- A user can manipulate data read by a connection by injecting \r\n sequence...
SECURITY: There is a security fix in the release
Security fixes
- A user can manipulate data read by a connection by injecting \r\n sequence...
SECURITY: There is a security fix in the release
Security fixes
- A user can manipulate data read by a connection by injecting \r\n sequence...
SECURITY: There is a security fix in the release
Security fixes
- A user can manipulate data read by a connection by injecting \r\n sequence...
SECURITY: There is a security fix in the release
Security fixes
- A user can manipulate data read by a connection by injecting \r\n sequence...
SECURITY: There is a security fix in the release
Security fixes
- A user can manipulate data read by a connection by injecting \r\n sequence...
This is the General Availability release of Redis 8.6 in Redis Open Source.
Major changes compared to 8.4
- Substantial performance improvem...
