Redis

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Security fixes

• (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
• Out-of-bounds access in TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
• Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
• Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• #15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• #14847 Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
• #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection
• ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
• Out-of-bounds argv access during key extraction when checking ACL permissions of a KEYNUM keyspec command (e.g. EVAL) with wrong arity
• Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

• Use-after-free in the TLS pending-data list when a command closes another pending connection

This is the General Availability release of Redis 8.10 in Redis Open Source.

Major changes compared to 8.8

• Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
• New command: HIMPORT - high-throughput compact hash bulk insertion
• TLS peer certificate-based server-to-server authentication
• New commands: LMOVEM, BLMOVEM - move multiple elements between lists
• New command: SUNIONCARD - get the cardinality of the union of multiple sets
• New command: SDIFFCARD - get the cardinality of the difference between sets
• New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
• XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
• New command: FT.ALIASLIST - get all aliases for the index
• Stemmer support for Malay and Tagalog languages
• JSONPath extensions
• New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
• New command: TS.READ - optionally blocking read
• New command: TS.QUERYLABELS - Get a list of labels and label-values
• New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
• Performance improvements

Binary distributions

• Alpine and Debian Docker images - https://hub.docker.com/_/redis
• Install using snap - see https://github.com/redis/redis-snap
• Install using brew - see https://github.com/redis/homebrew-redis
• Install using RPM - see https://github.com/redis/redis-rpm
• Install using Debian APT - see https://github.com/redis/redis-debian

Operating systems we test Redis 8.10 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

Bug fixes (compared to 8.10-RC2)

• #15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value
• #15453 Clients blocked on BLPOP, BLMOVE, or BLMOVEM could remain blocked after SORT with STORE replaced the target key with a list
• #15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed
• #15518 notify modules when node's own ip/port changes
• #15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled
• RediSearch/RediSearch#10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)
• RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)
• RediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)
• RediSearch/RediSearch#10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)
• RediSearch/RediSearch#10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)
• RediSearch/RediSearch#10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)

SECURITY: There is a security fix in the release.

Security fixes

• RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

SECURITY: There are security fixes in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
• RedisBloom/RedisBloom#1046 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

• RedisBloom/RedisBloom#1021 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free when loading a stream consumer group via RESTORE may lead to Remote Code Execution
• RedisBloom/RedisBloom#1039 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

• RedisBloom/RedisBloom#1020 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

SECURITY: There are security fixes in the release.

Security fixes

• Use-after-free when loading a stream consumer group via RESTORE may lead to Remote Code Execution
• RedisBloom/RedisBloom#1041 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

Bug fixes

• RedisBloom/RedisBloom#1019 Replicate CF.LOADCHUNK data chunks to prevent silent Cuckoo Filter data loss on failover

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

• A crafted stream RESTORE payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution

This is the second Release Candidate of Redis 8.10 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

Bug fixes (compared to 8.10-RC1)

• A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply
• A typo in release.h that could cause build failures

This is the first Release Candidate of Redis 8.10 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

Headlines:

Redis 8.10 introduces new features and performance improvements.

Operating systems we test Redis 8.10 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

New Features (compared to 8.8)

• #15364 Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
• #15364 New command: HIMPORT - high-throughput compact hash bulk insertion
• #15405 New commands: LMOVEM, BLMOVEM - move multiple elements between lists
• #14893 New command: SUNIONCARD - get the cardinality of the union of multiple sets
• #15278 New command: SDIFFCARD - get the cardinality of the difference between sets
• #15441 New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
• #15282 XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
• #15337 New SCRIPT_RUNNER command flag: flag commands that execute scripts or functions
• #15347 SLOWLOG GET - new reply argument: total argument count
• RediSearch/RediSearch#9626 New command: FT.ALIASLIST - get all aliases for the index (RED-197340)
• RediSearch/RediSearch#9052 Stemmer support for Malay and Tagalog languages (RED-132425)
• RediSearch/RediSearch#9291 FT.AGGREGATE - new COLLECT reducer: separate remote and local reducer invocations (RED-177887)
• RediSearch/RediSearch#8169, RediSearch/RediSearch#8236, RediSearch/RediSearch#9234, RediSearch/RediSearch#9443 — FT.SEARCH, FT.AGGREGATE, FT.HYBRID: enforce query TIMEOUT more strictly
  • The search-on-timeout policy now offers three options:
    • FAIL — reject timed-out queries. With search-workers > 0` (the default), the timeout is enforced preemptively
    • RETURN (default) — return best-effort partial results, without enforcing strictness during post-processing
    • RETURN_STRICT (new) — return best-effort partial results while enforcing the timeout through the post-processing (result) pipeline
  • Queries executed on the main thread (i.e., when search-workers is 0) are capped by search-_max-foreground-timeout-limit
• RedisJSON/RedisJSON#1602, RedisJSON/RedisJSON#1603, RedisJSON/RedisJSON#1604, RedisJSON/RedisJSON#1607, RedisJSON/RedisJSON#1618 JSONPath extensions (MOD-16274, MOD-16275):
  • Projection expressions at the top level of a JSONPath query
  • == and != can now compare any literal, including array and object literals
  • Filter negation operator: !
  • size/sizeof and empty operators on string, array, object, and nodelist
  • in and nin operators: membership test on an array and nodelist
  • Operators on numbers: binary -, +, *, /, %, and unary - and +
  • Operator on object: ~
  • length() function on array, object, and string
  • Functions on number: abs(), ceiling(), floor()
  • Functions on string: match(), search()
  • Strings concatenation with concat()
  • Functions on array: first(), last(), index(), append()
  • Aggregation functions on array: min(), max(), avg(), sum(), stddev()
  • Function on object: keys()
  • Function on nodelist: count()
  • Function on nodelist with exactly one node: value()
  • Relations functions on array and nodelist: subsetof(), anyof(), noneof()
• RedisTimeSeries/RedisTimeSeries#2052 New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp (RED-149232)
• RedisTimeSeries/RedisTimeSeries#2054 New command: TS.READ - optionally blocking read (RED-132421)
• RedisTimeSeries/RedisTimeSeries#2090 New command: TS.QUERYLABELS - Get a list of labels and label-values (RED-132355)
• RedisTimeSeries/RedisTimeSeries#2072 New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples (RED-132536)

Bug fixes (compared to 8.8.0)

• #15478 SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD, XREADGROUP - ACL permission bypass
• #15329, #15467 - I/O thread busy looping for replica clients
• #15466 Duplicate KeyMeta restoration in RESTORE-based AOF rewrites
• #15462 MEMORY USAGE over-reports memory consumption
• #15447 Full sync under heavy write load
• #15412 Unit mismatch disables the FAST expire cycle stale trigger
• #15392 Crash on VRANDMEMBER with LLONG_MIN count
• #15409 CONFIG SET - crash on of TLS options in non-TLS builds
• #15371 ACL key-name leak in BCAST client-side caching invalidations
• #15433 Signed overflow in BITFIELD offset parsing
• #15446 The select-based event loop backend enqueues registered file descriptors that select() did not mark ready
• #15309 mem_clients_normal drift when a replica drops its cached master after a failed partial resync
• #15357 Crash on missing module numeric config
• #15377 In-progress atomic slot migration tasks keep running on RM_ResetDataset and RM_RdbLoad
• #15391, #15356, #15436 NULL dereference
• #15390 Overflow on memory unit conversions
• #15291 SET does not enforce mutually exclusive NX/XX and IF* options
• #15322 CONFIG SET does not reject duplicate arguments when using both primary name and alias
• #15407 LSET out-of-range 64-bit index truncation
• #15308 Improve RDB load robustness (streams)
• #15263 Tighter cluster bus parsing for PING, PONG, and MEET packets
• #15247 Partial crash log on LoongArch architecture
• #15270 VADD ... CAS SETATTR - wrong attributes count
• RediSearch/RediSearch#10375 FT.CURSOR READ: crash after the underlying index was dropped (MOD-16703)
• RediSearch/RediSearch#10408 FT.SEARCH with LIMIT returns too many results in cluster mode over RESP3 (MOD-16767)
• RediSearch/RediSearch#10420 [FT.INFO](http://ft.info/) could report incorrect values for multi-value TAG fields after document updates (MOD-16745)
• RediSearch/RediSearch#10488 FT.INFO reports a negative num_records after garbage collection on indexes with an INDEXMISSING field (MOD-16940)
• RediSearch/RediSearch#10392 Vector search: crash (SIGSEGV) in FP32/L2 distance computation on x86 without AVX support, affecting certain vector dimensions (MOD-16730)
• RediSearch/RediSearch#9963 Range query returns incomplete results when the lower bound is an excluded empty string (MOD-15897)
• RediSearch/RediSearch#10066 FT.AGGREGATE .. WITHCOUNT coordinator leaks resources on timeout (MOD-16210)
• RediSearch/RediSearch#10247 Local FT.HYBRID ignores ON_TIMEOUT RETURN_STRICT and continues execution past the deadline (MOD-16492)
• RediSearch/RediSearch#10255 Blocked search clients trigger unnecessary query dumps, adding CPU and log overhead (MOD-16518)
• RediSearch/RediSearch#10151 FT.HYBRID supports EXPLAINSCORE, exposing the fusion method (RRF or LINEAR) (MOD-10044)
• RedisJSON/RedisJSON#1542, RedisJSON/RedisJSON#1543 Wrong results when evaluating paths with recursive descent (MOD-6722, MOD-14664)
• RedisJSON/RedisJSON#1554 Any literal that starts with true/false/null is interpreted as true/false/null (MOD-7266)
• RedisJSON/RedisJSON#1600 Improve RDB load robustness
• RedisTimeSeries/RedisTimeSeries#2067 TS.INFO - inaccurate memory usage calculation (MOD-6409)
• RedisTimeSeries/RedisTimeSeries#2036, RedisTimeSeries/RedisTimeSeries#2053, RedisTimeSeries/RedisTimeSeries#2056, #2074 Aggregation fixes (MOD-8187, MOD-16224, MOD-15565)
• RedisTimeSeries/RedisTimeSeries#2004, RedisTimeSeries/RedisTimeSeries#2051 Improve RDB load robustness
• RedisTimeSeries/RedisTimeSeries#2104 Issues after cluster topology changes
• RedisTimeSeries/RedisTimeSeries#2122 Error on the first cross-shard command (TLS)
• RedisTimeSeries/RedisTimeSeries#2109 TS.INCRBY with TIMESTAMP * replication timestamp drift
• RedisBloom/RedisBloom#1014 CF.LOADCHUNK partial replication (MOD-16050)
• RedisBloom/RedisBloom#1026, RedisBloom/RedisBloom#1027 Improve RDB load robustness

Performance and resource utilization improvements (compared to 8.8.0)

• #15376 Optimize lpSeek() by validating entries only when necessary
• #15345 Optimize wide HSET/HMSET on a fresh hash with a single batched listpack append
• #15330 Avoid recomputing allocator fragmentation twice per cron tick (RED-200844)
• #15259 Trim excess SDS allocation in inline command parsing
• #15256 rax memory reduction: leaf-inlining for fixed-length-key trees - improves XREADGROUP performance
• #15397 Improve RESTORE REPLACE performance for new keys
• #14704 Optimizes an internal memory accounting
• RediSearch/RediSearch#10246 Write operations block on a read lock held throughout vector range query result collection (MOD-16437)
• RediSearch/RediSearch#10392 Vector search: Reduce HNSW index memory usage with one-byte per-node locks (MOD-16696).
• RedisJSON/RedisJSON#1617 JSON - memory object footprint improvements (MOD-16608)

Modules API

• #15350 RedisModuleEvent_ClusterTopologyChange - cluster topology change
• #15327 REDISMODULE_SUBEVENT_FORK_CHILD_* - allow multi-threaded modules can quiesce background work before fork()
• #15373 REDISMODULE_SUBEVENT_CLUSTER_SLOT_MIGRATION_MIGRATE_MODULE_PROPAGATE_END - inject commands after ASM replication stream
• #15242 RedisModule_AddPostNotificationJobForKey - binds deferred work to a specific key from a keyspace-notification handler

Configuration parameters

• #15364 Compact hashes:
  • hash-rdb-load-min-template-entries - minimum field count to convert a plain hash to a template during load
  • hash-rdb-load-max-template-entries - maximum field count for load-time conversion
  • hash-rdb-load-template-disassembly-threshold - minimum number of keys a converted template must end up with to be kept

Metrics

• #15364 Compact hashes:
  • INFO STATS - hash_templates - number of distinct compact hash templates
  • INFO STATS - hash_template_keys - total number of keys backed by a compact hash template
  • INFO MEMORY - used_memory_hash_templates - total memory used by all compact hash templates
  • MEMORY STATS - hash.templates - total memory used by all compact hash templates
  • MEMORY USAGE <key> reports the key’s own + plus its share of a compact hash template cost

CLI tools

• #15352 Adds --latency-percentiles <p1,p2,...> to --latency / --latency-history: reporting user-chosen percentiles
• #15262 redis-cli --cluster rebalance - CROSSSLOT error on when using -user without -a
• #15338 redis-cli --cluster reshard and rebalance now move slots with server-side atomic slot migration

Update urgency: HIGH: There are critical bugs that may affect a subset of users.

Bug fixes

• #15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
• #15163 MULTI queue memory incorrect memory accounting
• #15115 Under-copy in the Lua debugger
• #15094 Cluster crash when CLIENT KILL unsubscribes SSUBSCRIBE client inside EXEC
• #14963 XREADGROUP: consumer replication inconsistency
• #14934 Client output buffer memory tracking not accounting for copy-avoided bulk string references
• #14970 Sentinel config injection via SENTINEL SET
• #14982 SCAN commands: integer overflow in COUNT parameter
• #15073 CLIENT TRACKING: self-overlap returning non-zero loop index
• #15059 Use-after-free
• #15037 XINFO STREAM: wrong value in the per-slot memory tracking
• #15034, #15081 Issues processing corrupt RDB data
• #15021 HEXPIRE: overflow on fields count
• #14942 Fix COMMAND GETKEYS for PFMERGE with no source keys
• #15188 cluster-announce-ip rejecting hostnames (regression)
• #14667, #14886 Potential TCP stalls/deadlocks
• RediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
• RediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)

Update urgency: HIGH: There are critical bugs that may affect a subset of users.

Bug fixes

• #15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
• #15163 MULTI queue memory incorrect memory accounting
• #14581 Rare server hang at shutdown
• #14545 ACL: AOF loading fails if ACL rules are changed and don't allow some commands in MULTI-EXEC
• #14537 SCAN: restore original filter order (revert change introduced in 8.2)
• #14816 setModuleEnumConfig() passing prefixed name to module callbacks
• #14659 ACL: Key-pattern bypass in MSETEX
• #14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies
• #14552 Streams: Incorrect behavior when using XDELEX...ACKEDafterXGROUP DESTROY`
• #14848 Crash during command processing on replicas performing full synchronization
• #15188 cluster-announce-ip rejecting hostnames (regression)
• #14667, #14886 Potential TCP stalls/deadlocks
• RediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
• RediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)

Update urgency: HIGH: There are critical bugs that may affect a subset of users.

Bug fixes

• #15175, RediSearch/RediSearch#9262 Redis fails to start on AArch64
• #14537 SCAN: restore original filter order (revert change introduced in 8.2)
• #14816 setModuleEnumConfig() passing prefixed name to module callbacks
• #14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies
• #14552 Streams: Incorrect behavior when using XDELEX...ACKEDafterXGROUP DESTROY`
• #14420 Shutdown blocked client not being properly reset after shutdown cancellation
• #14415 Potential crash in lookupKey() when executing_client is NULL
• #14417 CLUSTER FORGET - heap-buffer-overflow
• #15188 cluster-announce-ip rejecting hostnames (regression)
• #14667, #14886 Potential TCP stalls/deadlocks
• RediSearch/RediSearch#9484 Shard crash during background index scan of JSON documents with vector fields on Active-Active (CRDT) databases (MOD-15542)
• RediSearch/RediSearch#9635 Severe latency spikes and shard unresponsiveness when EXPIRE or EXPIREAT operations run concurrently with queries on large indexes (MOD-14930)

This is the General Availability release of Redis 8.8 in Redis Open Source.

Major changes compared to 8.6

• New data structure: Array (@antirez)
• Subkey notification for hash fields - field-level notifications
• INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)
• XNACK: a new streams command - allow consumers to explicitly release pending messages
• ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator
• JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays
• TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command
• FT.HYBRID KNN clause: new argument to request fewer candidates per shard
• FT.PROFILE HYBRID: profiling support for FT.HYBRID
• Performance improvements

Binary distributions

• Alpine and Debian Docker images - https://hub.docker.com/_/redis
• Install using snap - see https://github.com/redis/redis-snap
• Install using brew - see https://github.com/redis/homebrew-redis
• Install using RPM - see https://github.com/redis/redis-rpm
• Install using Debian APT - see https://github.com/redis/redis-debian

Operating systems we test Redis 8.8 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

Bug fixes (compared to 8.8-RC1)

• #15237 INCREX syntax update
• #15005 Memory tracking can be enabled at runtime in non-clustered mode
• RedisTimeSeries/RedisTimeSeries#1930 Cluster topology changes during a multi-shard command are not handled (MOD-14439)
• RedisBloom/RedisBloom#1007 Memory leak on RDB load (MOD-15418)

This is the first Release Candidate of Redis 8.8 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

Headlines:

Redis 8.8 introduces new features and performance improvements.

Operating systems we test Redis 8.8 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

Security fixes (compared to 8.8-M03)

• (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
• (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
• (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
• (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
• (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)

New Features (compared to 8.8-M03)

• #15162 New data structure: Array (@antirez)
• #15045 INCREX: a window counter rate limiter combining INCR,INCRBY,INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)
• In group sorting new reducer, allowing unwind grouped documents (after GROUPBY) and sort them

Removed Features (compared to 8.8-M03)

• #15191 Remove GCRA rate limiter

Bug fixes (compared to 8.8-M03)

• SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
• CONFIG SET: some settings allow invalid characters (RED-167787)
• SCRIPT DEBUG: potential crash on scripts (RED-175507)
• VADD: crash or buffer overflow on large REDUCE value (RED-170921)
• VSET: crash on huge allocations (MOD-12678)
• #15188 cluster-announce-ip rejecting hostnames (regression)
• #15095 Double free when loading streams with duplicate consumer PEL entries
• #15124 Issues processing corrupt Streams RDB data
• #15111 fast_float_strtod rounding mismatch
• #15190 vecClear reset the logical size without releasing element ownership
• #15163 MULTI queue memory incorrect memory accounting
• #15094 Cluster crash when CLIENT KILL unsubscribes SSUBSCRIBE client inside EXEC
• #15151 Listpack backlength encoding thresholds off-by-one
• #15115 Under-copy in the Lua debugger
• #14970 Sentinel config injection via SENTINEL SET
• #14934 Client output buffer memory tracking not accounting for copy-avoided bulk string references
• RediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty reply (MOD-14778)
• RediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
• RediSearch/RediSearch#9047 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
• RediSearch/RediSearch#9078 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)
• RediSearch/RediSearch#9012 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
• RediSearch/RediSearch#9066 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)
• RediSearch/RediSearch#9163 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
• RediSearch/RediSearch#9031, RediSearch/RediSearch#9473 Coordinator deadlock under mixed FT.SEARCH and FT.AGGREGATE load (MOD-14268)
• RediSearch/RediSearch#9028 Memory leak when FT.DROPINDEX runs concurrently with in-flight hybrid queries (MOD-14135)
• RediSearch/RediSearch#9310, RediSearch/RediSearch#9350 FT.CURSOR READ timeout and ON_TIMEOUT FAIL not enforced on coordinator and shard (MOD-14284, MOD-14998)
• RediSearch/RediSearch#9425 Cursors not cleaned up after MAXIDLE, causing resource exhaustion (MOD-6430)
• RediSearch/RediSearch#9234, RediSearch/RediSearch#9404 Coordinator RETURN_STRICT returns wrong data on partial results, including SORTBY pipeline (MOD-13617)
• RediSearch/RediSearch#9382 MAXPREFIXEXPANSION warnings not propagated to clients in cluster mode (MOD-13804)
• RediSearch/RediSearch#9218 Search commands fail when no worker thread is available instead of falling back to main thread (MOD-14921)
• RediSearch/RediSearch#9448 RDB load missing validation of FT.CREATE arguments, allowing corrupt index state on load (MOD-13118)
• RediSearch/RediSearch#9377 Use-after-move in Indexer_Process causes crash during indexing (MOD-14980)
• RediSearch/RediSearch#9408 Deadlock between background query and main-thread writer (MOD-15364)
• RediSearch/RediSearch#9114 FT.PROFILE prints output using wrong iterator type (MOD-14678)
• RediSearch/RediSearch#9421 Confusing error returned when DEBUG_PARAMS_COUNT is zero (MOD-15118)
• RediSearch/RediSearch#9045 Stack-smashing error in coordinator code path (MOD-14649)
• RedisJSON/RedisJSON#1554 Trailing chars are ignored (MOD-7266); Fixes RedisJSON/RedisJSON#976
• RedisJSON/RedisJSON#1543 Wrong mutation ordering for array commands with recursive paths (MOD-6722)
• RedisJSON/RedisJSON#1542 JSONPath evaluation issues (MOD-14664); Fixes RedisJSON/RedisJSON#968 (MOD-7264), RedisJSON/RedisJSON#962 (MOD-7272), RedisJSON/RedisJSON#963 (MOD-7270), RedisJSON/RedisJSON#1089 (MOD-7268)
• RedisTimeSeries/RedisTimeSeries#2003 Potential crash on disconnections and TLS failures (MOD-14850)
• RedisTimeSeries/RedisTimeSeries#2013 count, countNaN, countAll reducers return NaN when all values are NaN (MOD-14420)

Performance and resource utilization improvements (compared to 8.8-M03)

• #15049 Hyperloglog: 4 independent accumulators that are merged at the end
• #15133 Batched prefetch for MGET and MSET
• #14988 Batched prefetch for HGETALL on hashtable-encoded hashes
• #15071 Pass size hint to jemalloc for faster deallocation
• #15096 Reduces allocator and accounting overhead by adding compile-time jemalloc tuning
• RediSearch/RediSearch#9197 Vector index hot path (HNSW and brute-force) devirtualized, reducing per-query latency (MOD-14916)
• RediSearch/RediSearch#9262, RediSearch/RediSearch#9476 Inline LSE atomics enabled on AArch64, improving atomic operation throughput on ARM64 (MOD-14916, MOD-15419)
• RediSearch/RediSearch#9293 Expiration handling overhead reduced when many keys expire simultaneously (MOD-14916)
• RediSearch/RediSearch#9017 LTO (link-time optimization) enabled for x86_64 release builds (MOD-14700)
• RediSearch/RediSearch#8765 Shard-level timeout adjusted to coordinator dispatch time for more accurate accounting (MOD-13189)
• RediSearch/RediSearch#8790, RediSearch/RediSearch#8900, RediSearch/RediSearch#8827, RediSearch/RediSearch#8971, RediSearch/RediSearch#8966, RediSearch/RediSearch#8762, RediSearch/RediSearch#8678, RediSearch/RediSearch#8915, RediSearch/RediSearch#8653, RediSearch/RediSearch#9085, RediSearch/RediSearch#8751, RediSearch/RediSearch#8692, RediSearch/RediSearch#9224 Iterators ported to Rust, reducing FFI overhead
• RediSearch/RediSearch#9500 numRecords no longer updated for vector fields, removing unnecessary write overhead on ingest (MOD-15487)
• VecSim SVS thread pool integrated with the worker pool for better thread utilization (MOD-9881)

Configuration parameters

• #15182 Slowlog entry truncation limits:
  • slowlog-entry-max-argc: maximum number of command arguments kept in a slowlog entry
  • slowlog-entry-max-string-len: maximum length of a command argument in a slowlog entry
• RediSearch/RediSearch#8876, RediSearch/RediSearch#8960 Default maximum worker threads value updated; MAX_WORKER_THREADS is now a string config (MOD-14486, MOD-14763)

Metrics (compared to 8.8-M03)

• RediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)

CLI tools

• #15150 Memory leak on malformed legacy help entry in redis-cli

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
• (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
• (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
• (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
• (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)

Bug fixes

• SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
• CONFIG SET: some settings allow invalid characters (RED-167787)
• SCRIPT DEBUG: potential crash on scripts (RED-175507)
• VADD: crash or buffer overflow on large REDUCE value (RED-170921)
• VSET: crash on huge allocations (MOD-12678)
• Potential crash on disconnections and TLS failures (Time Series) (MOD-14850)
• RediSearch/RediSearch#8745 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
• RediSearch/RediSearch#8848 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
• RediSearch/RediSearch#8205, RediSearch/RediSearch#8259 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-12370, MOD-13884)
• RediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty reply (MOD-14778)
• RediSearch/RediSearch#8129, RediSearch/RediSearch#8140 FT.PROFILE reports an incorrect shard total profile time (MOD-13735, MOD-13181)
• RediSearch/RediSearch#9047 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
• RediSearch/RediSearch#8791 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
• RediSearch/RediSearch#8382 Crash when indexing negative zero (-0.0) (MOD-13904)
• RediSearch/RediSearch#8590 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
• RediSearch/RediSearch#8660 FILTER behavior depends on property order in the expression (MOD-14065)
• RediSearch/RediSearch#8593 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
• RediSearch/RediSearch#8591 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
• RediSearch/RediSearch#8589 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14328)
• RediSearch/RediSearch#9012 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
• RediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
• RediSearch/RediSearch#8462 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
• RediSearch/RediSearch#9066 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)
• RediSearch/RediSearch#8109, RediSearch/RediSearch#8149 Configuration registration omits module parameters, causing them to be unexposed or misapplied (RED-171841)
• RediSearch/RediSearch#9163 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
• RediSearch/RediSearch#8395 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828)
• RediSearch/RediSearch#8451 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14079)
• RediSearch/RediSearch#9078 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)
• RediSearch/RediSearch#8051, RediSearch/RediSearch#8114 Crash diagnostics now include the IndexSpec of the index the failing thread was working on (MOD-7574)

Metrics

• RediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
• (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
• (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
• (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
• (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)

Bug fixes

• SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
• CONFIG SET: some settings allow invalid characters (RED-167787)
• SCRIPT DEBUG: potential crash on scripts (RED-175507)
• VADD: crash or buffer overflow on large REDUCE value (RED-170921)
• VSET: crash on huge allocations (MOD-12678)
• Potential crash on disconnections and TLS failures (Time Series) (MOD-14850)
• RediSearch/RediSearch#8744 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
• RediSearch/RediSearch#8849 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
• RediSearch/RediSearch#8258 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-13885)
• RediSearch/RediSearch#9183 FT.PROFILE HYBRID returns an empty reply (MOD-14778)
• RediSearch/RediSearch#9048 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
• RediSearch/RediSearch#8792 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
• RediSearch/RediSearch#8384 Crash when indexing negative zero (-0.0) (MOD-13904)
• RediSearch/RediSearch#8596 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
• RediSearch/RediSearch#8661 FILTER behavior depends on property order in the expression (MOD-14065)
• RediSearch/RediSearch#8598 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
• RediSearch/RediSearch#8597 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
• RediSearch/RediSearch#8595 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14062)
• RediSearch/RediSearch#9011 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
• RediSearch/RediSearch#9080 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
• RediSearch/RediSearch#8461 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
• RediSearch/RediSearch#9091 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)
• RediSearch/RediSearch#9161 Coordinator deadlock under mixed FT.SEARCH and FT.AGGREGATE load (MOD-14268)
• RediSearch/RediSearch#9165 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
• RediSearch/RediSearch#8394 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828)
• RediSearch/RediSearch#8452 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14080)
• RediSearch/RediSearch#9077 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)

Metrics

• RediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
• (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
• (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
• (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
• (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)

Bug fixes

• SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
• CONFIG SET: some settings allow invalid characters (RED-167787)
• SCRIPT DEBUG: potential crash on scripts (RED-175507)
• VADD: crash or buffer overflow on large REDUCE value (RED-170921)
• VSET: crash on huge allocations (MOD-12678)
• Potential crash on disconnections and TLS failures (Time Series) (MOD-14850)
• RediSearch/RediSearch#8743 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
• RediSearch/RediSearch#8850 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
• RediSearch/RediSearch#9178 Coordinator deadlock under mixed FT.SEARCH and FT.AGGREGATE load (MOD-14268)
• RediSearch/RediSearch#9049 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
• RediSearch/RediSearch#8793 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
• RediSearch/RediSearch#8600 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
• RediSearch/RediSearch#8662 FILTER behavior depends on property order in the expression (MOD-14342)
• RediSearch/RediSearch#8602 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
• RediSearch/RediSearch#8601 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
• RediSearch/RediSearch#8599 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14062)
• RediSearch/RediSearch#9019 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
• RediSearch/RediSearch#9081 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
• RediSearch/RediSearch#8464 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
• RediSearch/RediSearch#8888 FT.CURSOR enters an infinite loop when the ACL user lacks specific permissions (MOD-14479)
• RediSearch/RediSearch#9166 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
• RediSearch/RediSearch#8453 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14081)
• RediSearch/RediSearch#9076 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)

Metrics

• RediSearch/RediSearch#8235 FT.PROFILE: added queue time tracking (MOD-13602)

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
• (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
• (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution

Bug fixes

• SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
• CONFIG SET: some settings allow invalid characters (RED-167787)
• SCRIPT DEBUG: potential crash on scripts (RED-175507)

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
• (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
• (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution

Bug fixes

• SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
• CONFIG SET: some settings allow invalid characters (RED-167787)
• SCRIPT DEBUG: potential crash on scripts (RED-175507)

Update urgency: SECURITY: There is a security fix in the release.

Security fixes

• (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution

Bug fixes

• SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
• SCRIPT DEBUG: potential crash on scripts (RED-175507)

This is the third Milestone of Redis 8.8 in Redis Open Source.

Milestones are non-feature-complete pre-releases. Pre-releases are not suitable for production use.

Headlines:

Redis 8.8 introduces new features and performance improvements.

Operating systems we test Redis 8.8 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

New Features (compared to 8.8-M02)

• #14958 Subkey notification for hash fields - field-level notifications
• RediSearch/RediSearch#8227 FT.HYBRID KNN clause: new argument to request fewer candidates per shard
• RediSearch/RediSearch#8060 FT.PROFILE HYBRID: profiling support for FT.HYBRID

Bug fixes (compared to 8.8-M02)

• #15034, #15081 Issues processing corrupt RDB data
• #15059 Use-after-free
• #15073 CLIENT TRACKING: self-overlap returning non-zero loop index
• #14982 SCAN commands: integer overflow in COUNT parameter
• #14956 Crash on HSETEX when a field appears more than once and an expiry is specified
• #15015 Change log level for unknown extension types from LL_WARNING to LL_VERBOSE
• #14995 Unnecessary -ERR and \r\n
• RediSearch/RediSearch#8708 Crash when many keys receive expirations under heavy TTL activity
• RediSearch/RediSearch#8774 Coordinator deadlock under mixed FT.SEARCH and FT.AGGREGATE load
• RediSearch/RediSearch#8415 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable)
• RediSearch/RediSearch#8322 Crash when indexing negative zero (-0.0)
• RediSearch/RediSearch#8843 HNSW vector index memory growth under high-churn workloads until shard restart
• RediSearch/RediSearch#8396 FILTER returns inconsistent results with multiple indexes sharing field aliases
• RediSearch/RediSearch#8205 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results
• RediSearch/RediSearch#8817 Instability and crashes in long-running search cursors during concurrent index updates
• RediSearch/RediSearch#8388 FT.SEARCH fails with “Query requires unavailable slots” after shard restart or failover
• RediSearch/RediSearch#8548 FILTER behavior depends on property order in the expression
• RediSearch/RediSearch#8320 Index FILTER applied inconsistently when documents are missing filtered fields
• RediSearch/RediSearch#8752 Missing blocked-client FAIL timeout mechanism for coordinator-level FT.AGGREGATE
• RediSearch/RediSearch#8657 Missing shard-level FAIL timeout handling for FT.HYBRID queries
• RediSearch/RediSearch#8420 Missing coordinator-level FAIL timeout handling for FT.HYBRID queries
• RediSearch/RediSearch#8335 Legacy shard-level FAIL handling for FT.SEARCH / FT.AGGREGATE
• RediSearch/RediSearch#8191 FT.SEARCH coordinator lacks strict FAIL timeout enforcement

Performance and resource utilization improvements (compared to 8.8-M02)

• #15114 Optimize SET key value GET
• #15065, #15118 Scan commands key collection: replace list with append-only pointer vector
• #15061 Widen fast_float_strtod fast path to 17-19 digit mantissas
• RediSearch/RediSearch#8378 Optimize filter expression evaluation: skip indexes not matching the document type (MOD-14064)

Metrics (compared to 8.8-M02)

• RediSearch/RediSearch#8246 ‘frontend_buffer_size’, ‘HNSW_main_thread_insertion’: metrics for tiered vector indexes (MOD-13819)
• RediSearch/RediSearch#8210 FT.PROFILE: added queue time tracking (MOD-13602)
• RediSearch/RediSearch#8283 INFO: Skip metrics when there are no indices (MOD-13903)
• RediSearch/RediSearch#7417 Add unique error message ids for improved debugging and troubleshooting (MOD-11806)

Configuration parameters

• RediSearch/RediSearch#8876 search-workers: change default to 16 (MOD-14486)
• RediSearch/RediSearch#8352 BG_INDEX_SLEEP_DURATION_US: sleep duration during background indexing (MOD-13994)

This is the second Milestone of Redis 8.8 in Redis Open Source.

Milestones are non-feature-complete pre-releases. Pre-releases are not suitable for production use.

Headlines:

Redis 8.8 introduces new features and performance improvements.

8.8-M02 is available as a Docker image and can be downloaded from Docker Hub. Additional distributions will be introduced in upcoming pre-releases.

Operating systems we test Redis 8.8 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)
• Rocky Linux 8.10, 9.7, 10.1
• AlmaLinux 8.10, 9.7, 10.1
• Debian 12.13 (Bookworm), Debian 13.4 (Trixie)
• Alpine 3.23
• macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

New Features (compared to 8.6)

• #14826, #14905 GCRA (generic cell rate algorithm) rate limiter (based on the redis-cell module by @brandur - thank you!)
• #14797 XNACK: a new streams command that allows consumers to explicitly release pending messages
• RedisJSON/RedisJSON#1509 JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays (MOD-13577)
• #14892 ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator
• RedisTimeSeries/RedisTimeSeries#1916 TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command (MOD-9162)

Bug fixes (compared to 8.6.2)

• #15037 XINFO STREAM: wrong value in the per-slot memory tracking
• #12000 Incorrect shrinking of querybuf when client is reading a big argv
• #15021 HEXPIRE: overflow on fields count
• #14963 XREADGROUP: consumer replication inconsistency
• #15011 Double-free in rdbLoadObject
• #14667, #14886 Potential TCP stalls/deadlocks
• #14942 Fix COMMAND GETKEYS for PFMERGE with no source keys
• #14888 Hardens safety check in lpSafeToAdd
• #14748 Ensure sensitive user data is not exposed in logs when hide_user_data_from_log is enabled
• #14877 INFO KEYSIZES and INFO ALLOCSIZES` fixes
• #14878 listpack memory leak in zipmap-to-hash conversion on error path
• #14955 Streams: IDMP-related bug
• #14974, #14932, #14866 Memory leaks
• #14790 Missing initialization
• #14789 DB hash tables not expanding during RDB load on standalone-mode
• #14785 Add HOTKEYS HELP subcommand (Each command having subcommands needs a HELP subcommand)
• #14784 RESTORE and SET: expiredkeys counter updates incorrectly on keys with past expiration time
• #14779 Accurate memory accounting for RedisModuleDict (instead of estimation)
• #14774 Missing cleanup code in getKeysFreeResult() on cross-slot error path
• #14771 Potential unsigned integer underflow in used_memory_dataset calculation
• #14780 Fixed name of HOTKEYS results field sampled-command-selected-slots-us to sampled-commands-selected-slots-us
• #14756 HOTKEYS does not track each command in a MULTI/EXEC block
• #14749 Fixed HOTKEYS GET RESP3 reply fixed to map instead of flat array
• RedisJSON/RedisJSON#1520 Numeric operations on homogeneous arrays: promote to next type if results overflow (MOD-14427)
• RedisJSON/RedisJSON#1519 JSON.NUMINCRBY, JSON.NUMMULTBY don’t error on numeric overflow (MOD-14191)
• RedisJSON/RedisJSON#1487 Depth limit (128) was not fully enforced (MOD-4107)
• RedisTimeSeries/RedisTimeSeries#1910 TS.INCRBY, TS.DECRBY create key before validating args (MOD-8167)
• RedisTimeSeries/RedisTimeSeries#1908 Potential crash on TS.RANGE with aggregation and EMPTY
• RedisTimeSeries/RedisTimeSeries#1896 Potential memory leak (MOD-13438)
• RedisTimeSeries/RedisTimeSeries#1913 ACL rules are not fully enforced for multi-key commands on a cluster setup (MOD-14124)

Performance and resource utilization improvements (compared to 8.6.2)

• #15003 Reduce overhead in command propagation
• #14979 Dismiss dict bucket arrays in fork child to reduce CoW
• #14661 Replace fast_float C++ library with pure C implementation
• #14928 Disable memory tracking in child processes
• #14885 Optimize rax (radix tree) insert and lookup for sequential key patterns
• #14335 Handle primary/replica clients in I/O threads
• #14754 Optimize prefetching commands
• #14770 Optimize BITOP operations with AVX512
• #14862 Streams: Filter expired IDMP entries during RDB save and load
• #14750 SFLUSH can now flush slots partially
• #14887 SFLUSH skips slot trimming when the requested slot ranges exactly match the node’s local slot coverage
• #14851 Skip RDB checksum computation/validation during diskless full synchronization to reduce CPU overhead
• #14783 Pause dict auto-resize during multi-field deletion
• RedisTimeSeries/RedisTimeSeries#1884 TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: improve performance on a cluster setup (RED-184104)
• RedisTimeSeries/RedisTimeSeries#1866 Register to type_changed KSN instead of set (MOD-12919)

Modules API

• #14445 Allow modules to associate metadata with keys
  • RedisModule_CreateKeyMetaClass - define a new key-metadata class
  • RedisModule_ReleaseKeyMetaClass - release a key-metadata class
  • RedisModule_SetModuleMetadata - attach or update metadata to a key
  • RedisModule_GetKeyMeta - get key metadata

Metrics

• #14896 INFO STATS - global stats for slowlog metrics:
  • slowlog_commands_count - commands written to slowlog
  • slowlog_commands_time_ms_sum - sum of execution times of commands from the slowlog
  • slowlog_commands_time_ms_max - maximum execution time of a command from the slowlog
• #14896 INFO COMMANDSTATS - per-command stats for slowlog metrics:
  • slowlog_count - number of times the command was written in the slowlog
  • slowlog_time_ms_sum - sum of execution time of the command (only from the slowlog)
  • slowlog_time_ms_max - maximum execution time of the command (only from the slowlog) -14841 INFO STATS (global, all clients aggregated):
  • total_client_processing_events: attempts to process client input buffers; does not guarantee any command was actually parsed
  • eventloop_cycles_with_clients_processing: event loop cycles where client input buffers were processed
  • commands_per_parse_batch_sum: cumulative number of commands parsed across all parsing batches for all clients
  • commands_per_parse_batch_cnt: number of parsing batches across all clients. A batch is counted each time at least one command is parsed from a client's query buffer
  • commands_per_parse_batch_avg: average commands parsed per batch (sum/cnt). Approximates pipelining depth -#14841 CLIENT INFO and CLIENT LIST (per-client):
  • read-events: number of read events for this client
  • parse-batch-cmd-sum: cumulative number of commands parsed across all parsing batches for this client
  • parse-batch-cnt: total number of parsing batches for this client. Divide parse-batch-cmd-sum by this value to get the client’s average commands per batch

CLI tools

• #14371 Divide-by-zero in redis-benchmark and redis-cli
• #14863 Memory leak in redis-cli
• #14703 redis-cli --keystats: fix percentile calculation

Bug fixes

• #14824 Potential UAF: don't use reply copy avoidance for module strings
• #14848 Crash during command processing on replicas performing full synchronization
• #14794 New XIDMPRECORD internal command and AOFRW emission to restore stream IDMP state
• #14816 setModuleEnumConfig() passing prefixed name to module callbacks
• #14858 Streams: Ensures XADD with IDMP/IDMPAUTO that hits an existing IID records the metadata change
• #14855, #14831, #14817 Potential memory leaks
• #14869 Streams: IDMP cron expiration not working after RDB load
• #14847 Potential crash during ACL checks on wrong-arity commands
• #14883 HSETEX, HGETEX do not validate that FIELDS is specified only once
• #14897 Streams: IDMP-related bugs

SECURITY: There is a security fix in the release

Security fixes

• A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

SECURITY: There is a security fix in the release

Security fixes

• A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

SECURITY: There is a security fix in the release

Security fixes

• A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

SECURITY: There is a security fix in the release

Security fixes

• A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

SECURITY: There is a security fix in the release

Security fixes

• A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

SECURITY: There is a security fix in the release

Security fixes

• A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

Bug fixes

• #14785 HOTKEYS: The INFO command may display module information, and the missing HOTKEYS HELP subcommand has been added
• #14789 Bug in RDB loading prevented hash table expansion, increasing load time

This is the General Availability release of Redis 8.6 in Redis Open Source.

Major changes compared to 8.4

• Substantial performance improvements
• Substantial memory reduction for hashes (hashtable-encoded) and sorted sets (skiplist-encoded)
• Streams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments
• New eviction policies - least recently modified: volatile-lrm and allkeys-lrm
• Hot keys detection and reporting; new command: HOTKEYS
• TLS certificate-based automatic client authentication
• Time series: support NaN values; new aggregators: COUNTNAN and COUNTALL

For more details, see the 8.6 release blog post.

Binary distributions

• Alpine and Debian Docker images - https://hub.docker.com/_/redis
• Install using snap - see https://github.com/redis/redis-snap
• Install using brew - see https://github.com/redis/homebrew-redis
• Install using RPM - see https://github.com/redis/redis-rpm
• Install using Debian APT - see https://github.com/redis/redis-debian

Operating systems we test Redis 8.6 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)
• Rocky Linux 8.10, 9.5
• AlmaLinux 8.10, 9.5, 10.1
• Debian 12 (Bookworm), Debian 13 (Trixie)
• macOS 14 (Sonoma), 15 (Sequoia)

New Features (compared to 8.6-RC1)

• #14695 Keys memory size histograms

Performance and resource utilization improvements (compared to 8.6-RC1)

• #14714 Optimize user ACL permission verification
• #14692 Optimize peak memory metric collection
• #14739 Avoid allocating and releasing list node in reply copy avoidance
• #14713 Reduce per command syscalls by reusing cached time when hardware monotonic clock is available
• #14726 Optimize XREADGROUP CLAIM
• #13962 Vector set: replace manual popcount with __builtin_popcountll for binary vector distance (Intel, AMD, ARM)
• #14474 Vector set: vectorized the quantized 8-bit vector distance calculation (Intel, AMD)
• #14492 Vector set: vectorize binary quantization path for vectorsets distance calculation (Intel, AMD)

Configuration parameters

• #14719 cluster-slot-stats-enabled - per-slot resource consumptions statistics to collect
• #14695 key-memory-histograms collect memory consumption histograms per data type

Metrics

• #14695 db0_distrib_lists_sizes, db0_distrib_sets_sizes, db0_distrib_hashes_sizes, db0_distrib_zsets_sizes

known bugs and limitations

• Streams: avoid using XADD with the new IDMP or IDMPAUTO options when using appendonly yes with aof-use-rdb-preamble no (non default). This limitation will be removed in the next patch.

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log
• RedisBloom/RedisBloom#936 Cuckoo filter: crash on RDB load on 0 buckets (MOD-11593)
• RedisBloom/RedisBloom#945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)

Bug fixes

• #14637 Atomic slot migration: wrong adjacent slot range behavior
• #14567 Atomic slot migration: support delay trimming slots after finishing migrating slots
• #14746 CLUSTER SLOT-STATS: Fix few memory tracking bugs
• RedisTimeSeries/RedisTimeSeries#1864 Atomic slot migration: time series limitations (MOD-13611)
• RediSearch/RediSearch#6973 Correct empty string token counting in byteOffset calculations to ensure accurate text position tracking (MOD-11233)
• RediSearch/RediSearch#6995 Prevent FT.INFO command fanout to replicas to reduce unnecessary cluster traffic
• RediSearch/RediSearch#7154 Display Background Indexing OOM warning in FT.AGGREGATE when memory limits are approached (MOD-11817)
• RediSearch/RediSearch#7219 Resolve concurrency issue in FT.AGGREGATEreducer that caused intermittent errors (MOD-12243)
• RediSearch/RediSearch#7255 Correct BM25STD underflow wraparound to prevent incorrect scoring (MOD-12223)
• RediSearch/RediSearch#7264 Ensure accurate totalDocsLen updates to maintain correct document statistics (MOD-12234)
• RediSearch/RediSearch#7275 Report used memory as unsigned long to prevent overflow (RED-169833)
• RediSearch/RediSearch#7350 FT.CREATE with LeanVec parameters on non-Intel architectures (RED-176382)
• RediSearch/RediSearch#7371 Validate search-min-operation-workers min value correctly (MOD-12383)
• RediSearch/RediSearch#7430 Prevent coordinator deadlock in FT.HYBRID queries by avoiding index read lock (MOD-12489)
• RediSearch/RediSearch#7435 Ensure full profile output on timeout with RETURN policy in FT.PROFILE (MOD-12320)
• RediSearch/RediSearch#7446 Remove outdated validation from debug aggregate in cluster mode (MOD-12435)
• RediSearch/RediSearch#7455 Ensure internal cursors are deleted immediately in cluster mode (MOD-12493)
• RediSearch/RediSearch#7458 Correct GC regression that caused stability issues (MOD-12538)
• RediSearch/RediSearch#7460 Prevent potential double-free on error path in Fork GC (MOD-12521)
• RediSearch/RediSearch#7499 Propagate HGETALL command in HDT mode (MOD-12662)
• RediSearch/RediSearch#7534 Reduce number of worker threads asynchronously to prevent performance degradation (MOD-12252, MOD-11658)
• RediSearch/RediSearch#7553 Handle WITHSCORES correctly when SCORE is sent alone without extra fields in coordinator (MOD-12647)
• RediSearch/RediSearch#7560 Properly handle connection closing in IO thread at shutdown and fix searchRequestCtx freeing on error (MOD-12699)
• RediSearch/RediSearch#7685 Resolve cursor logical leak that could lead to resource exhaustion (MOD-12807)
• RediSearch/RediSearch#7710 Support for WITHCOUNT in FT.AGGREGATE (MOD-11751)
• RediSearch/RediSearch#7794 Correctly handle binary data with embedded NULLs to prevent crashes (MOD-13010)
• RediSearch/RediSearch#7812 Correct SVS GC for no-workers case (MOD-12983)
• RediSearch/RediSearch#7815 Fix command routing in cluster mode by not relying on shard index (MOD-13049)
• RediSearch/RediSearch#7823 Support vector blob only through parameter in FT.HYBRID(MOD-13123)
• RediSearch/RediSearch#7873 Handle warnings in empty FT.AGGREGATE replies in cluster mode (MOD-12640)
• RediSearch/RediSearch#7897 Remove asserts from DownloadFile to prevent crash (MOD-13096)
• RediSearch/RediSearch#7901 Support multiple warnings in reply to prevent warning loss (MOD-13252)
• RediSearch/RediSearch#7903 Eliminate memory leak in FT.HYBRID queries with Active-Active enabled (MOD-13143)
• RediSearch/RediSearch#7886 Remove non-TEXT fields from spec's keys dictionary to prevent incorrect field handling (MOD-13150)
• RediSearch/RediSearch#7905 Remove non-TEXT fields from spec's keys dictionary and refactor keys dict (MOD-13150, MOD-13151)
• RediSearch/RediSearch#7978 Avoid using negative key position values during command registration (MOD-13332)
• RediSearch/RediSearch#8052 Resolve incorrect results when using LOAD * with FT.HYBRID (MOD-12736, MOD-13556)
• RediSearch/RediSearch#8083 Correct FULLTEXT field metric count accuracy (MOD-13432)
• RediSearch/RediSearch#8089 Handle edge case in clusterset (MOD-13562)
• RediSearch/RediSearch#8151 Correct FT.PROFILE shard total profile time calculation (MOD-13735, MOD-13181)
• RediSearch/RediSearch#8153 Resolve config registration issue (RED-171841)
• RediSearch/RediSearch#7449 Ensure FT.HYBRID respects timeout settings (MOD-11004)
• RediSearch/RediSearch#7238 Initialize GIL_TIME properly for FT.PROFILE (MOD-12553)
• RediSearch/RediSearch#7453 Error behavior on early bailout and split OOM warning for shard and coordinator (MOD-12449)
• RediSearch/RediSearch#7615 Parameter numDocs from non-optimized Wildcard iterator (MOD-12392)
• RediSearch/RediSearch#7165 (Redis Enterprise only) FT.DROPINDEX as touches-arbitrary-keys for proper cluster handling causing crash on A-A (MOD-11090)
• RediSearch/RediSearch#7023 (Redis Enterprise only) Ensure all FT.SUG* commands are hashslot-aware to prevent cluster routing errors (MOD-11756)

Performance and resource utilization improvements

• RediSearch/RediSearch#7496 Vector search performance improvements (MOD-12011, MOD-12063, MOD-12629, MOD-12346)
• RediSearch/RediSearch#7519 Reduce number of worker threads asynchronously to improve resource utilization (MOD-12252, MOD-11658)
• RediSearch/RediSearch#7694 Use asynchronous jobs in GC for SVS to reduce blocking (MOD-12668)
• RediSearch/RediSearch#7730 Support filter_policy and batch_size parameters for vector similarity search tuning (MOD-13007, MOD-12371)
• RediSearch/RediSearch#7782 Resolve SVS GC failures when worker threads are disabled (MOD-12983)
• RediSearch/RediSearch#7572 Implement ASM state machine on notifications (MOD-12170)
• RediSearch/RediSearch#7829 ASM-aware search flow for Active-Active deployments (MOD-12171, MOD-12169)
• RediSearch/RediSearch#7589 Support multiple slot ranges in search.CLUSTERSET for flexible cluster topology updates (MOD-11657)
• RediSearch/RediSearch#7862 Support subquery count in FT.HYBRID (MOD-11858, MOD-13146)
• RediSearch/RediSearch#7893 Request policy support for cursor operations (MOD-13146, MOD-9573, MOD-8104)
• RediSearch/RediSearch#8087 Warning when cursor may give inaccurate results due to Active-Active replication (MOD-12899)
• RediSearch/RediSearch#7445 Remove outdated validation from Debug Aggregate in cluster mode (MOD-12435)
• RediSearch/RediSearch#7384 Reduce index load from RDB temporary memory overhead (MOD-12212)

Metrics

• RediSearch/RediSearch#7960 Persist query warnings across cursor reads (MOD-12984)
• RediSearch/RediSearch#7612 Track maxprefixexpansions errors and warnings in info (MOD-12417)
• RediSearch/RediSearch#7872 Handle warnings in empty FT.AGGREGATE replies in cluster mode (MOD-12640)
• RediSearch/RediSearch#7900 Support multiple warnings in reply (MOD-13252)
• RediSearch/RediSearch#7576 Track OOM errors and warnings in info (MOD-12418)
• RediSearch/RediSearch#7507 Track timeout errors and warnings in info (MOD-12419)
• RediSearch/RediSearch#7341 Rename FT.PROFILE counter fields for clarity (MOD-6056)
• RediSearch/RediSearch#7436, RediSearch/RediSearch#7427 Enhance FT.PROFILE with vector search execution details (MOD-12263)
• RediSearch/RediSearch#7573 Debug support for FT.PROFILE command (MOD-12627)
• RediSearch/RediSearch#7736 Add Internal cursor reads metric to cluster FT.PROFILE output (MOD-12414)
• RediSearch/RediSearch#7692 Declare query error struct on _FT.CURSOR PROFILE (MOD-12955)
• RediSearch/RediSearch#7848 Store and display shard ID in profile output (MOD-12321)
• RediSearch/RediSearch#7422 Track syntax and argument errors in query error metrics (MOD-12416)
• RediSearch/RediSearch#7552 Add active_io_threads metric (MOD-12069, MOD-12695)
• RediSearch/RediSearch#7622 Add active_coord_threads metric (MOD-12694, MOD-12069)
• RediSearch/RediSearch#7564 Add active_worker_threads metric (MOD-12694, MOD-12069)
• RediSearch/RediSearch#7626 Add *_pending_jobs metrics for job queues (MOD-12069)
• RediSearch/RediSearch#7658 Add pending workers admin jobs metric (MOD-12069, MOD-12791)
• RediSearch/RediSearch#7731 Add active_topology_update_threads metric (MOD-12069, MOD-12790)
• RediSearch/RediSearch#7760 Extend indexing metrics for more detailed performance data (MOD-12070)

Configuration parameters

• RediSearch/RediSearch#7083 Add default scorer configuration option (MOD-10037)

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

• RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log

Bug fixes

• RedisJSON/RedisJSON#1430 Malformed panic log messages (MOD-9365)
• RedisBloom/RedisBloom#945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)
• RediSearch/RediSearch#6973 Correct empty string token counting in byteOffset calculations to ensure accurate text position tracking (MOD-11233)
• RediSearch/RediSearch#6995 Prevent FT.INFO command fanout to replicas to reduce unnecessary cluster traffic
• RediSearch/RediSearch#7034 Correct goto statement handling on RDB load
• RediSearch/RediSearch#7154 Display Background Indexing OOM warning in FT.AGGREGATE when memory limits are approached (MOD-11817)
• RediSearch/RediSearch#7219 Resolve concurrency issue in Reducer that caused intermittent errors (MOD-12243)
• RediSearch/RediSearch#7255 Correct BM25STD underflow wraparound to prevent incorrect scoring (MOD-12223)
• RediSearch/RediSearch#7264 Ensure accurate totalDocsLen updates to maintain correct document statistics (MOD-12234)
• RediSearch/RediSearch#7275 Report used memory as unsigned long to prevent overflow (RED-169833)
• RediSearch/RediSearch#7350 Allow FT.CREATE with LeanVec parameters on non-Intel architectures (RED-176382)
• RediSearch/RediSearch#7384 Reduce index load from RDB temporary memory overhead (MOD-12212)
• RediSearch/RediSearch#7435 Ensure full profile output on timeout with RETURN policy in FT.PROFILE (MOD-12320)
• RediSearch/RediSearch#7446 Remove outdated validation from debug aggregate in cluster mode (MOD-12435)
• RediSearch/RediSearch#7458 Correct GC regression that caused stability issues (MOD-12538)
• RediSearch/RediSearch#7459 Prevent potential double-free in Fork GC error path (MOD-12521)
• RediSearch/RediSearch#7470 Remove draining from Flush callback to avoid blocking
• RediSearch/RediSearch#7499 Propagate HGETALL command in HDT mode (MOD-12662)
• RediSearch/RediSearch#7534 Reduce number of worker threads asynchronously to prevent performance degradation (MOD-12252, MOD-11658)
• RediSearch/RediSearch#7554 Handle Coordinator case when SCORE is sent alone without extra fields (MOD-12647)
• RediSearch/RediSearch#7561 Prevent memory corruption when freeing searchRequestCtx on error (MOD-12699)
• RediSearch/RediSearch#7685 Resolve cursor logical leak that could lead to resource exhaustion (MOD-12807)
• RediSearch/RediSearch#7710 Add support for WITHCOUNT in FT.AGGREGATE (MOD-11751)
• RediSearch/RediSearch#7794 Correctly handle binary data with embedded NULLs to prevent crashes (MOD-13010)
• RediSearch/RediSearch#7812 Correct SVS GC for no-workers case (MOD-12983)
• RediSearch/RediSearch#7873 Handle warnings in empty FT.AGGREGATE replies in cluster mode (MOD-12640)
• RediSearch/RediSearch#7886 Remove non-TEXT fields from spec's keys dictionary to prevent incorrect field handling (MOD-13150)
• RediSearch/RediSearch#7901 Support multiple warnings in reply to prevent warning loss (MOD-13252)
• RediSearch/RediSearch#8083 Correct FULLTEXT field metric count accuracy (MOD-13432)
• RediSearch/RediSearch#8153 Resolve config registration issue (RED-171841)
• RediSearch/RediSearch#7371 Validate search-min-operation-workers min value correctly (MOD-12383)
• RediSearch/RediSearch#8151 Correct FT.PROFILE shard total profile time calculation (MOD-13735, MOD-13181)
• RediSearch/RediSearch#7165 (Redis Enterprise only) FT.DROPINDEX as touches-arbitrary-keys for proper cluster handling causing crash on A-A (MOD-11090)
• RediSearch/RediSearch#7023 (Redis Enterprise only) Ensure all FT.SUG* commands are hashslot-aware to prevent cluster routing errors (MOD-11756)

Performance and resource utilization improvements

• RediSearch/RediSearch#7496 Vector search performance improvements (MOD-12011, MOD-12063, MOD-12629, MOD-12346)
• RediSearch/RediSearch#7694 Use asynchronous jobs in GC for SVS to reduce blocking (MOD-12668)

Metrics

• RediSearch/RediSearch#7614 Track timeout errors and warnings in info (MOD-12419)
• RediSearch/RediSearch#7646 Track maxprefixexpansions errors and warnings in info (MOD-12417)
• RediSearch/RediSearch#7957 Persist query warnings across cursor reads (MOD-12984)
• RediSearch/RediSearch#7341 Rename FT.PROFILE counter fields for clarity (MOD-6056)
• RediSearch/RediSearch#7436 Enhance FT.PROFILE with vector search execution details (MOD-12263)
• RediSearch/RediSearch#7737 Add Internal cursor reads metric to cluster FT.PROFILE output (MOD-12414)
• RediSearch/RediSearch#7692 Declare query error struct on _FT.CURSOR PROFILE (MOD-12955)
• RediSearch/RediSearch#7552 Add active_io_threads metric (MOD-12069, MOD-12695)
• RediSearch/RediSearch#7564 Add active_worker_threads metric (MOD-12694, MOD-12069)
• RediSearch/RediSearch#7623 Add active_coord_threads metric (MOD-12694, MOD-12069)
• RediSearch/RediSearch#7626 Add *_pending_jobs metrics for job queues (MOD-12069)
• RediSearch/RediSearch#7672 Add pending workers admin jobs metric (MOD-12069, MOD-12791)
• RediSearch/RediSearch#7732 Introduce active_topology_update_threads metric (MOD-12069, MOD-12790)
• RediSearch/RediSearch#7759 Extend indexing metrics for better observability (MOD-12070)

Configuration parameters

• RediSearch/RediSearch#7083 Add default scorer configuration option (MOD-10037)

This is the first Release Candidate of Redis 8.6 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

Binary distributions

• Alpine and Debian Docker images - https://hub.docker.com/_/redis
• Install using snap - see https://github.com/redis/redis-snap
• Install using brew - see https://github.com/redis/homebrew-redis
• Install using RPM - see https://github.com/redis/redis-rpm
• Install using Debian APT - see https://github.com/redis/redis-debian

Operating systems we test Redis 8.6 on

• Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat)
• Rocky Linux 8.10, 9.5, 10.1
• AlmaLinux 8.10, 9.5, 10.1
• Debian 12 (Bookworm), Debian 13 (Trixie)
• 14 (Sonoma), 15 (Sequoia)

New Features (compared to 8.4.0)

• #14615 Streams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments
• #14624 New eviction policies - least recently modified: volatile-lrm and allkeys-lrm
• #14680 Hot keys detection and reporting; new command: HOTKEYS
• #14610 TLS certificate-based automatic client authentication
• RedisTimeSeries/RedisTimeSeries#1853 Time series: support NaN values; new aggregators: COUNTNAN and COUNTALL

Security and privacy fixes

• #14645 Hide Personally Identifiable Information from ACL log
• #14659 ACL: Key-pattern bypass in MSETEX
• RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log
• RedisBloom/RedisBloom#950 Out-of-bounds read when loading an invalid RDB file (MOD-12802)

Bug fixes (compared to 8.4.0)

• #14545 ACL: AOF loading fails if ACL rules are changed and don't allow some commands in MULTI-EXEC
• #14637 Atomic slot migration: wrong adjacent slot range behavior
• #14567 Atomic slot migration: support delay trimming slots after finishing migrating slots
• #14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies
• #14552 Streams: Incorrect behavior when using XDELEX...ACKEDafterXGROUP DESTROY`
• #14537 SCAN: restore original filter order (revert change introduced in 8.2)
• #14581 Rare server hang at shutdown
• #14597 Panic when cluster node is uninitialized
• #14583 FLUSHALL ASYNC on a writable replica may block the main thread for an extended period
• #14504 Cluster: fix race condition in broadcast configuration
• #14416 Fixed argument position handling in Redis APIs
• RedisTimeSeries/RedisTimeSeries#1784, RedisTimeSeries/RedisTimeSeries#1839, RedisBloom/RedisBloom#952, RedisJSON/RedisJSON#1477 Atomic slot migration support
• RedisBloom/RedisBloom#946 MEMORY USAGE: fix reported value (MOD-12799)
• RedisJSON/RedisJSON#1473 Adding escapes to already-escaped characters (MOD-8137)
• RedisJSON/RedisJSON#1475 JSON.CLEAR does not error if more than one path is specified (MOD-13109)

Performance and resource utilization improvements (compared to 8.4.0)

• #14608 Reply copy-avoidance path to reduce memory copies for bulk string replies
• #14595 Hash: unify field name and value into a single struct
• #14701 Sorted set: unify score and value into a single struct
• #14662 Optimize listpack iterator on hash fields
• #14699 Optimize set commands with expiration
• #14700 Optimize prefetching
• #14715 Optimize prefetch sizing logic
• #14636 Optimize ZRANK
• #14676 Utilize hardware clock by default on ARM AArch64
• #14575 Disable RDB compression when diskless replication is used

Modules API

• #14445
  • RM_CreateKeyMetaClass - define a new key-metadata class
  • RM_ReleaseKeyMetaClass - release a key-metadata class
  • RM_SetKeyMeta - attach or update a metadata value for a key under a specific metadata-key class
  • RM_GetKeyMeta - get a metadata value for a key under a specific metadata-key class

Configuration parameters

• #14624 maxmemory-policy: new eviction policies: volatile-lrm, allkeys-lrm
• #14615 stream-idmp-duration, stream-idmp-maxsize - defaults for streams idempotent production
• #14610 tls-auth-clients-user TLS certificate-based automatic client authentication
• #14596 flushdb option for repl-diskless-load: always flush the entire dataset before diskless load

Metrics

• #14610 acl_access_denied_tls_cert - failed TLS certificate–based authentication attempts

known bugs and limitations

• Redis Query Engine: In case of load rebalancing operations (such as Atomic Slot Migration) taking place during the lifetime of a cursor, there is a chance that some results may be missing.