openSUSE-SU-2026:21612-1

This update for redis fixes the following issues:

Changes in redis:

• Update to 8.10.1

  Update urgency: SECURITY: There are security fixes in the release.

  • Security fixes
    • (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
    • Out-of-bounds access in TopK heap cleanup path (MOD-15410)
    • Use-after-free in the TLS pending-data list when a command closes another pending connection
    • A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
    • Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
    • Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
    • Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
    • TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
    • #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

• Restrict the "modules" flavour to x86_64 and aarch64 -- RedisBloom and RedisTimeSeries abort on anything else with "only supports 64-bit architectures (x64, arm64v8)", redisjson's vendored redis-module is 64-bit only, and modules/common.mk maps no other architecture at all

• Update to 8.10.0

  Major changes compared to 8.8

  • Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
  • New command: HIMPORT - high-throughput compact hash bulk insertion
  • TLS peer certificate-based server-to-server authentication
  • New commands: LMOVEM, BLMOVEM - move multiple elements between lists
  • New command: SUNIONCARD - get the cardinality of the union of multiple sets
  • New command: SDIFFCARD - get the cardinality of the difference between sets
  • New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
  • XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
  • New command: FT.ALIASLIST - get all aliases for the index
  • Stemmer support for Malay and Tagalog languages
  • JSONPath extensions
  • New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
  • New command: TS.READ - optionally blocking read
  • New command: TS.QUERYLABELS - Get a list of labels and label-values
  • New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
  • Performance improvements

• Update to 8.8.1 Security fixes

  • RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

• Update to 8.8.0

  • New data structure: Array (@antirez)
  • Subkey notification for hash fields - field-level notifications
  • INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)
  • XNACK: a new streams command - allow consumers to explicitly release pending messages
  • ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator
  • JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays
  • TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command
  • FT.HYBRID KNN clause: new argument to request fewer candidates per shard
  • FT.PROFILE HYBRID: profiling support for FT.HYBRID
  • Performance improvements

• Updated to 8.6.3 (boo#1264164 boo#1264165 boo#1264166 boo#1264167 boo#1264168)

  • Security fixes
    • (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.
    • (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution
    • (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution
    • (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series)
    • (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic)
  • Bug fixes
    • SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
    • CONFIG SET: some settings allow invalid characters (RED-167787)
    • SCRIPT DEBUG: potential crash on scripts (RED-175507)
    • VADD: crash or buffer overflow on large REDUCE value (RED-170921)
    • VSET: crash on huge allocations (MOD-12678)
    • Potential crash on disconnections and TLS failures (Time Series) (MOD-14850)
    • RediSearch/RediSearch#8745 Crash when many keys receive expirations under heavy TTL activity (MOD-14500)
    • RediSearch/RediSearch#8848 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761)
    • RediSearch/RediSearch#8205, RediSearch/RediSearch#8259 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-12370, MOD-13884)
    • RediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty reply (MOD-14778)
    • RediSearch/RediSearch#8129, RediSearch/RediSearch#8140 FT.PROFILE reports an incorrect shard total profile time (MOD-13735, MOD-13181)
    • RediSearch/RediSearch#9047 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560)
    • RediSearch/RediSearch#8791 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461)
    • RediSearch/RediSearch#8382 Crash when indexing negative zero (-0.0) (MOD-13904)
    • RediSearch/RediSearch#8590 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063)
    • RediSearch/RediSearch#8660 FILTER behavior depends on property order in the expression (MOD-14065)
    • RediSearch/RediSearch#8593 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064)
    • RediSearch/RediSearch#8591 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948)
    • RediSearch/RediSearch#8589 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14328)
    • RediSearch/RediSearch#9012 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800)
    • RediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596)
    • RediSearch/RediSearch#8462 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066)
    • RediSearch/RediSearch#9066 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732)
    • RediSearch/RediSearch#8109, RediSearch/RediSearch#8149 Configuration registration omits module parameters, causing them to be unexposed or misapplied (RED-171841)
    • RediSearch/RediSearch#9163 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475)
    • RediSearch/RediSearch#8395 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828)
    • RediSearch/RediSearch#8451 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14079)
    • RediSearch/RediSearch#9078 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655)
    • RediSearch/RediSearch#8051, RediSearch/RediSearch#8114 Crash diagnostics now include the IndexSpec of the index the failing thread was working on (MOD-7574)
  • Metrics
    • RediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602)

• Updated to 8.6.2 (boo#1260399)

  • Fixed potential UAF: don't use reply copy avoidance for module strings.
  • Fixed crash during command processing on replicas performing. full synchronization.
  • Fixed potential Memory leaks.
  • Fixed potential crash during ACL checks on wrong-arity commands.
  • Fixed HSETEX HGETEX do not validate that FIELDS is specified only once.

• Updated to 8.6.1 (boo#1258706)

  • Fixed user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply.
  • Fixed INFO command may display module information, and the missing HOTKEYS HELP subcommand has been added.
  • Fixed RDB loading prevented hash table expansion.

• Updated to 8.6.0

  Major changes compared to 8.4

  • Substantial performance improvements
  • Substantial memory reduction for hashes (hashtable-encoded) and sorted sets (skiplist-encoded)
  • Streams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments
  • New eviction policies - least recently modified: volatile-lrm and allkeys-lrm
  • Hot keys detection and reporting; new command: HOTKEYS
  • TLS certificate-based automatic client authentication
  • Time series: support NaN values; new aggregators: COUNTNAN and COUNTALL

  New Features

  • #14695 Keys memory size histograms
  • #14615 Streams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments
  • #14624 New eviction policies - least recently modified: volatile-lrm and allkeys-lrm
  • #14680 Hot keys detection and reporting; new command: HOTKEYS
  • #14610 TLS certificate-based automatic client authentication
  • RedisTimeSeries/RedisTimeSeries#1853 Time series: support NaN values; new aggregators: COUNTNAN and COUNTALL Security and privacy fixes
  • #14645 Hide Personally Identifiable Information from ACL log
  • #14659 ACL: Key-pattern bypass in MSETEX
  • RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log
  • RedisBloom/RedisBloom#950 Out-of-bounds read when loading an invalid RDB file (MOD-12802) Bugfixes
  • #14545 ACL: AOF loading fails if ACL rules are changed and don't allow some commands in MULTI-EXEC
  • #14637 Atomic slot migration: wrong adjacent slot range behavior
  • #14567 Atomic slot migration: support delay trimming slots after finishing migrating slots
  • #14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies
  • #14552 Streams: Incorrect behavior when using XDELEX...ACKEDafterXGROUP DESTROY`
  • #14537 SCAN: restore original filter order (revert change introduced in 8.2)
  • #14581 Rare server hang at shutdown
  • #14597 Panic when cluster node is uninitialized
  • #14583 FLUSHALL ASYNC on a writable replica may block the main thread for an extended period
  • #14504 Cluster: fix race condition in broadcast configuration
  • #14416 Fixed argument position handling in Redis APIs
  • RedisTimeSeries/RedisTimeSeries#1784, RedisTimeSeries/RedisTimeSeries#1839, RedisBloom/RedisBloom#952, RedisJSON/RedisJSON#1477 Atomic slot migration support
  • RedisBloom/RedisBloom#946 MEMORY USAGE: fix reported value (MOD-12799)
  • RedisJSON/RedisJSON#1473 Adding escapes to already-escaped characters (MOD-8137)
  • RedisJSON/RedisJSON#1475 JSON.CLEAR does not error if more than one path is specified (MOD-13109) Performance and resource utilization improvements
  • #14608 Reply copy-avoidance path to reduce memory copies for bulk string replies
  • #14595 Hash: unify field name and value into a single struct
  • #14701 Sorted set: unify score and value into a single struct
  • #14662 Optimize listpack iterator on hash fields
  • #14699 Optimize set commands with expiration
  • #14700 Optimize prefetching
  • #14715 Optimize prefetch sizing logic
  • #14636 Optimize ZRANK
  • #14676 Utilize hardware clock by default on ARM AArch64
  • #14575 Disable RDB compression when diskless replication is used
  • #14714 Optimize user ACL permission verification
  • #14692 Optimize peak memory metric collection
  • #14739 Avoid allocating and releasing list node in reply copy avoidance
  • #14713 Reduce per command syscalls by reusing cached time when hardware monotonic clock is available
  • #14726 Optimize XREADGROUP CLAIM
  • #13962 Vector set: replace manual popcount with __builtin_popcountll for binary vector distance (Intel, AMD, ARM)
  • #14474 Vector set: vectorized the quantized 8-bit vector distance calculation (Intel, AMD)
  • #14492 Vector set: vectorize binary quantization path for vectorsets distance calculation (Intel, AMD) Configuration parameters
  • #14719 cluster-slot-stats-enabled - per-slot resource consumptions statistics to collect
  • #14695 key-memory-histograms collect memory consumption histograms per data type Metrics
  • #14695 db0_distrib_lists_sizes, db0_distrib_sets_sizes, db0_distrib_hashes_sizes, db0_distrib_zsets_sizes
  • #14610 acl_access_denied_tls_cert - failed TLS certificate–based authentication attempts Modules API
  • #14445
    • RM_CreateKeyMetaClass - define a new key-metadata class
    • RM_ReleaseKeyMetaClass - release a key-metadata class
    • RM_SetKeyMeta - attach or update a metadata value for a key under a specific metadata-key class
    • RM_GetKeyMeta - get a metadata value for a key under a specific metadata-key class Configuration parameters
  • #14624 maxmemory-policy: new eviction policies: volatile-lrm, allkeys-lrm
  • #14615 stream-idmp-duration, stream-idmp-maxsize - defaults for streams idempotent production
  • #14610 tls-auth-clients-user TLS certificate-based automatic client authentication
  • #14596 flushdb option for repl-diskless-load: always flush the entire dataset before diskless load Known bugs and limitations
  • Streams: avoid using XADD with the new IDMP or IDMPAUTO options when using appendonly yes with aof-use-rdb-preamble no (non default). This limitation will be removed in the next patch.
  • Redis Query Engine: In case of load rebalancing operations (such as Atomic Slot Migration) taking place during the lifetime of a cursor, there is a chance that some results may be missing.

• Updated to 8.4.1

  • https://github.com/redis/redis/releases/tag/8.4.1
  • Atomic slot migration: wrong adjacent slot range behavior.
  • Atomic slot migration: support delay trimming slots after finishing migrating slots.
  • Fixed CLUSTER SLOT-STATS few memory tracking bugs.

• Updated to 8.4.0

  • Major changes compared to 8.2
    • DIGEST, DELEX; SET extensions - atomic compare-and-set and compare-and-delete for string keys
    • MSETEX - atomically set multiple string keys and update their expiration
    • XREADGROUP - new CLAIM option for reading both idle pending and incoming stream entries
    • CLUSTER MIGRATION - atomic slot migration
    • CLUSTER SLOT-STATS - per-slot usage metrics: key count, CPU time, and network I/O
    • Redis query engine: FT.HYBRID - hybrid search and fused scoring
    • Redis query engine: I/O threading with performance boost for search and query commands (FT.*)
    • I/O threading: substantial throughput increase (e.g. >30% for caching use cases (10% SET, 90% GET), 4 cores)
    • JSON: substantial memory reduction for homogenous arrays (up to 91%)