releases.shpreview
RedisRedis/redis

RCE via RESTORE fixed; Cuckoo filter data loss prevented

v8.2.8

July 23, 2026redisView original ↗
3 fixesThis release3 fixesBug fixesAI-tallied from the release notes
From the original release noteView original ↗

SECURITY: There are security fixes in the release.

Security fixes

  • Use-after-free when loading a stream consumer group via RESTORE may lead to Remote Code Execution
  • RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

Fetched July 23, 2026