The developers of the in-memory database system Redis have released a series of updated versions. They close security vulnerabilities that malicious actors could abuse to execute injected code, trigger denial-of-service conditions, or gain unauthorized access to information. If you run Redis, you should plan the update promptly.
These versions are affected
On Monday evening, the developers released versions 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24. Not every vulnerability is present in the older releases, but you should still apply the update matching your version soon.
Only one flaw with an official CVE entry
The Redis developers name a CVE entry for only one of the vulnerabilities, and it isn't public yet, with its severity rating still unknown. CVE-2026-62356 describes an incorrectly calculated buffer size when loading RDB files, which can lead to out-of-bounds heap writes. The developers don't explain whether this merely causes a crash or could also be used to execute smuggled-in code.
A different flaw, not yet assigned a CVE entry, looks more serious: maliciously crafted RDB data with an out-of-bounds slot ID can trigger memory errors while loading, potentially leading to the execution of injected code. Also notable is a vulnerability that allows bypassing TLS certificate authentication. A client could use this to impersonate another user, in the worst case one with higher privileges. The descriptions of the remaining flaws suggest attackers could use them to trigger denial-of-service conditions or gain unauthorized access to memory regions and the information stored there.
Background: AI-assisted vulnerability hunting
In July, it emerged that a security researcher had used the Chinese AI Kimi K3 to find several security flaws in Redis, ultimately turning up 19 zero-day vulnerabilities. The current updates are the Redis developers' response to those findings. The case once again shows how AI-assisted vulnerability hunting is driving up the number of reported flaws in widely used software.