Critical RCE patches for stream RESTORE, Bloom, TDigest
v8.6.5
4 fixesThis release4 fixesBug fixesAI-tallied from the release notes
From the original release noteView original ↗
SECURITY: There are security fixes in the release.
Security fixes
- A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
- RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
Bug fixes
- RedisBloom/RedisBloom#1021 Replicate
CF.LOADCHUNKdata chunks to prevent silent Cuckoo Filter data loss on failover
Fetched July 23, 2026
