Redis Open Source 8.10 release notes

====================================

--------------------------------------------------------------------------------

Upgrade urgency levels:

LOW: No need to upgrade unless there are new features you want to use.

MODERATE: Program an upgrade of the server, but it's not urgent.

HIGH: There is a critical bug that may affect a subset of users. Upgrade!

CRITICAL: There is a critical bug affecting MOST USERS. Upgrade ASAP.

SECURITY: There are security fixes in the release.

--------------------------------------------------------------------------------

The release notes contain PRs from multiple repositories:

#n - Redis (https://github.com/redis/redis)

#Qn = Query Engine (https://github.com/RediSearch/RediSearch)

#Jn = JSON (https://github.com/RedisJSON/RedisJSON)

#Tn = Time Series (https://github.com/RedisTimeSeries/RedisTimeSeries)

#Pn = Probabilistic (https://github.com/RedisBloom/RedisBloom)

================================================================================

Redis 8.10.2 Released Thu 17 Sep 2026 18:00:00 IST

================================================================================

Update urgency: `SECURITY`: There are security fixes in the release.

### Security fixes

- #15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed

- #15722 The cluster bus protocol has no authentication of its own unless `tls-cluster` is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new `cluster-bus-port-protected-mode` option (default `no`) makes refusing to run in that state an explicit choice: set it to `yes` and the node starts only when `tls-cluster` authenticates the bus

- TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload

- RedisSearch: KNN queries on indexes with very long vector field names could cause the server to crash

- Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

================================================================================

Redis 8.10.1 Released Mon 17 Aug 2026 10:00:00 IST

================================================================================

Update urgency: `SECURITY`: There are security fixes in the release.

### Security fixes

- (CVE-2026-62356) Miscalculated buffer size in `CMSketch` RDB loading may lead to heap OOB write

- Out-of-bounds access in TopK heap cleanup path (MOD-15410)

- Use-after-free in the TLS pending-data list when a command closes another pending connection

- A malicious RDB payload with an out-of-range `SLOT_INFO` slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution

- Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access

- Vector Sets: use-after-free when `VREM` mutates the HNSW graph while background `VSIM` threads are still running

- Vector Sets: a negative `hnsw_search()` return was treated as a huge unsigned count, reading past the end of the result arrays

- TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user

- #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

==================================================================

Redis 8.10 GA Released Wed 29 Jul 2026 21:00:00 IST

==================================================================

This is the General Availability release of Redis 8.10 in Redis Open Source.

### Major changes compared to 8.8

- Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema

- New command: `HIMPORT` - high-throughput compact hash bulk insertion

- TLS peer certificate-based server-to-server authentication

- New commands: `LMOVEM`, `BLMOVEM` - move multiple elements between lists

- New command: `SUNIONCARD` - get the cardinality of the union of multiple sets

- New command: `SDIFFCARD` - get the cardinality of the difference between sets

- New command: `BACKUP` - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)

- `XREAD`, `XREADGROUP` - new `MAXCOUNT` and `MAXSIZE` arguments to cap the cumulative reply entries and size

- New command: `FT.ALIASLIST` - get all aliases for the index

- Stemmer support for Malay and Tagalog languages

- JSONPath extensions

- New commands: `TS.NRANGE`, `TS.NREVRANGE` - Query a range across multiple time series; group results by timestamp

- New command: `TS.READ` - optionally blocking read

- New command: `TS.QUERYLABELS` - Get a list of labels and label-values

- New command: `TS.MRANGE`, `TS.MREVRANGE` - new `EXCLUDEEMPTY` argument to exclude series with no reported samples

- Performance improvements

### Binary distributions

- Alpine and Debian Docker images - https://hub.docker.com/_/redis

- Install using snap - see https://github.com/redis/redis-snap

- Install using brew - see https://github.com/redis/homebrew-redis

- Install using RPM - see https://github.com/redis/redis-rpm

- Install using Debian APT - see https://github.com/redis/redis-debian

### Operating systems we test Redis 8.10 on

- Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)

- Rocky Linux 8.10, 9.7, 10.1

- AlmaLinux 8.10, 9.7, 10.1

- Debian 12.13 (Bookworm), Debian 13.4 (Trixie)

- Alpine 3.23

- macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

### Bug fixes (compared to 8.10-RC2)

- #15513 Prevented a division-by-zero error when active defragmentation thresholds are configured with equal or reversed value

- #15453 Clients blocked on `BLPOP`, `BLMOVE`, or `BLMOVEM` could remain blocked after `SORT` with `STORE` replaced the target key with a list

- #15499 Memory usage reported for compressed replication clients could be lower than the actual memory consumed

- #15518 notify modules when node's own ip/port changes

- #15539 Loading an AOF file with an RDB preamble could fail when active defragmentation was enabled

- #Q10528 Crash in the numeric range tree when background garbage collection encounters an empty leaf during active indexing on a numeric field. (MOD-16877)

- #Q10605 FT.CREATE and FT.ALTER now reject an empty string as a field name, preventing a crash loop in the fork-GC on indexes with an empty TAG field. (MOD-17034)

- #Q10488 FT.INFO reports a negative num_records after garbage collection on indexes that include an INDEXMISSING field. (MOD-16940)

- #Q10568 Cluster FT.AGGREGATE fails with SEARCH_FIELD_DUP when a GROUPBY contains multiple REDUCE COLLECT calls over the same field differing only in option-keyword casing. (MOD-16365)

- #Q10605 FT.CREATE and FT.ALTER now return an error when a field name is an empty string; previously such schemas were accepted silently. (MOD-17034)

- #Q10522 coord_total_query_warnings_timeout double-counts timeout warnings for FT.SEARCH queries that use a hybrid (vector + filter) execution path. (MOD-15973)

==================================================================

Redis 8.10-RC2 (v8.9.241) Released Mon 20 Jul 2026 21:00:00 IST

==================================================================

This is the second Release Candidate of Redis 8.10 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

### Bug fixes (compared to 8.10-RC1)

- A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

- A typo in release.h that could cause build failures

==================================================================

Redis 8.10-RC1 (v8.9.240) Released Mon 20 Jul 2026 18:00:00 IST

==================================================================

This is the first Release Candidate of Redis 8.10 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

### Headlines:

Redis 8.10 introduces new features and performance improvements.

### Operating systems we test Redis 8.10 on

- Ubuntu 22.04 (Jammy Jellyfish), 24.04 (Noble Numbat), 26.04 (Resolute Raccoon)

- Rocky Linux 8.10, 9.7, 10.1

- AlmaLinux 8.10, 9.7, 10.1

- Debian 12.13 (Bookworm), Debian 13.4 (Trixie)

- Alpine 3.23

- macOS 14.8.4 (Sonoma), 15.7.4 (Sequoia), 26.3 (Tahoe) - for both Intel and ARM

### New Features (compared to 8.8)

- #15364 Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema

- #15366 Replication stream compression to reduce bandwidth consumption between primaries and replicas

- #15364 New command: `HIMPORT` - high-throughput compact hash bulk insertion

- #15405 New commands: `LMOVEM`, `BLMOVEM` - move multiple elements between lists

- #14893 New command: `SUNIONCARD` - get the cardinality of the union of multiple sets

- #15278 New command: `SDIFFCARD` - get the cardinality of the difference between sets

- #15441 New command: `BACKUP` - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)

- #15282 `XREAD`, `XREADGROUP` - new `MAXCOUNT` and `MAXSIZE` arguments to cap the cumulative reply entries and size

- #15337 New `SCRIPT_RUNNER` command flag: flag commands that execute scripts or functions

- #15347 `SLOWLOG GET` - new reply argument: total argument count

- #Q9626 New command: `FT.ALIASLIST` - get all aliases for the index (RED-197340)

- #Q9052 New Languages Search: Stemmer support for Malay and Tagalog languages (RED-132425)

- #Q9291 `FT.AGGREGATE` now supports whole-document fetching using `COLLECT`, in-group SORTBY/LIMIT, and deduplication control within a single query. (RED-177887)

- #Q8169, #Q8236, #Q9234, #Q9443 — `FT.SEARCH`, `FT.AGGREGATE`, `FT.HYBRID`: enforce query `TIMEOUT` more strictly; long-running queries require vertical scaling (multi-threaded execution). (RED-132340)

- use `FAIL` when correctness requires rejecting timed-out queries. With `search-workers` > 0` (the default), the timeout is enforced preemptively

- use `RETURN` when best-effort partial results are acceptable and strictness not enforced at post-processing time.

- use `RETURN_STRICT` when best-effort partial results are acceptable and strictness enforced on post-processing.

- New parameter `search-global-timeout` acting as cap value to timeout setting on query time TIMEOUT param

- #J1602, #J1603, #J1604, #J1607, #J1618 JSONPath extensions (MOD-16274, MOD-16275):

- Projection expressions at the top level of a JSONPath query

- `==` and `!=` can now compare any literal, including array and object literals

- Filter negation operator: `!`

- `size`/`sizeof` and `empty` operators on string, array, object, and nodelist

- `in` and `nin` operators: membership test on an array and nodelist

- Operators on numbers: binary `-`, `+`, `*`, `/`, `%`, and unary `-` and `+`

- Operator on object: `~`

- `length()` function on array, object, and string

- Functions on number: `abs()`, `ceiling()`, `floor()`

- Functions on string: `match()`, `search()`

- Strings concatenation with `concat()`

- Functions on array: `first()`, `last()`, `index()`, `append()`

- Aggregation functions on array: `min()`, `max()`, `avg()`, `sum()`, `stddev()`

- Function on object: `keys()`

- Function on nodelist: `count()`

- Function on nodelist with exactly one node: `value()`

- Relations functions on array and nodelist: `subsetof()`, `anyof()`, `noneof()`

- #T2052 New commands: `TS.NRANGE`, `TS.NREVRANGE` - Query a range across multiple time series; group results by timestamp (RED-149232)

- #T2054 New command: `TS.READ` - optionally blocking read (RED-132421)

- #T2090 New command: `TS.QUERYLABELS` - Get a list of labels and label-values (RED-132355)

- #T2072 New command: `TS.MRANGE`, `TS.MREVRANGE` - new `EXCLUDEEMPTY` argument to exclude series with no reported samples (RED-132536)

### Bug fixes (compared to 8.8.0)

- #15478 `SORT`, `GEORADIUS`, `GEORADIUSBYMEMBER`, `XREAD`, `XREADGROUP` - ACL permission bypass

- #15329, #15467 - I/O thread busy looping for replica clients

- #15466 Duplicate KeyMeta restoration in `RESTORE`-based AOF rewrites

- #15462 `MEMORY USAGE` over-reports memory consumption

- #15447 Full sync under heavy write load

- #15412 Unit mismatch disables the FAST expire cycle stale trigger

- #15392 Crash on `VRANDMEMBER` with `LLONG_MIN` count

- #15409 `CONFIG SET` - crash on of TLS options in non-TLS builds

- #15371 ACL key-name leak in BCAST client-side caching invalidations

- #15433 Signed overflow in `BITFIELD` offset parsing

- #15446 The select-based event loop backend enqueues registered file descriptors that `select()` did not mark ready

- #15309 `mem_clients_normal` drift when a replica drops its cached master after a failed partial resync

- #15357 Crash on missing module numeric config

- #15377 In-progress atomic slot migration tasks keep running on `RM_ResetDataset` and `RM_RdbLoad`

- #15391, #15356, #15436 NULL dereference

- #15390 Overflow on memory unit conversions

- #15291 `SET` does not enforce mutually exclusive `NX`/`XX` and `IF*` options

- #15322 `CONFIG SET` does not reject duplicate arguments when using both primary name and alias

- #15407 `LSET` out-of-range 64-bit index truncation

- #15308 Improve RDB load robustness (streams)

- #15263 Tighter cluster bus parsing for `PING`, `PONG`, and `MEET` packets

- #15247 Partial crash log on LoongArch architecture

- #15270 `VADD ... CAS SETATTR` - wrong attributes count

- #Q10375 `FT.CURSOR READ`: crash after the underlying index was dropped (MOD-16703)

- #Q10408 `FT.SEARCH` with `LIMIT` returns too many results in cluster mode over RESP3 (MOD-16767)

- #Q10420 `FT.INFO` could report incorrect values for multi-value TAG fields after document updates (MOD-16745)

- #Q10488 `FT.INFO` reports a negative `num_records` after garbage collection on indexes with an `INDEXMISSING` field (MOD-16940)

- #Q10392 Vector search: crash (SIGSEGV) in FP32/L2 distance computation on x86 without AVX support, affecting certain vector dimensions (MOD-16730)

- #Q9963 Range query returns incomplete results when the lower bound is an excluded empty string (MOD-15897)

- #Q10066 `FT.AGGREGATE .. WITHCOUNT` coordinator leaks resources on timeout (MOD-16210)

- #Q10247 Local `FT.HYBRID` ignores `ON_TIMEOUT RETURN_STRICT` and continues execution past the deadline (MOD-16492)

- #Q10255 Blocked search clients trigger unnecessary query dumps, adding CPU and log overhead (MOD-16518)

- #Q10151 `FT.HYBRID` supports `EXPLAINSCORE`, exposing the fusion method (`RRF` or `LINEAR`) (MOD-10044)

- #J1542, #J1543 Wrong results when evaluating paths with recursive descent (MOD-6722, MOD-14664)

- #J1554 Any literal that starts with true/false/null is interpreted as true/false/null (MOD-7266)

- #J1600 Improve RDB load robustness

- #T2067 `TS.INFO` - inaccurate memory usage calculation (MOD-6409)

- #T2036, #T2053, #T2056, #2074 Aggregation fixes (MOD-8187, MOD-16224, MOD-15565)

- #T2004, #T2051 Improve RDB load robustness

- #T2104 Issues after cluster topology changes

- #T2122 Error on the first cross-shard command (TLS)

- #T2109 `TS.INCRBY` with `TIMESTAMP *` replication timestamp drift

- #P1014 `CF.LOADCHUNK` partial replication (MOD-16050)

- #P1026, #P1027 Improve RDB load robustness

### Performance and resource utilization improvements (compared to 8.8.0)

- #15376 Optimize `lpSeek()` by validating entries only when necessary

- #15345 Optimize wide `HSET`/`HMSET` on a fresh hash with a single batched listpack append

- #15330 Avoid recomputing allocator fragmentation twice per cron tick (RED-200844)

- #15259 Trim excess SDS allocation in inline command parsing

- #15256 rax memory reduction: leaf-inlining for fixed-length-key trees - improves `XREADGROUP` performance

- #15397 Improve `RESTORE REPLACE` performance for new keys

- #14704 Optimizes an internal memory accounting

- #Q10246 Write operations block on a read lock held throughout vector range query result collection (MOD-16437)

- #Q10392 Vector search: Reduce HNSW index memory usage with one-byte per-node locks (MOD-16696).

- #J1617, #JIJSON9 JSON - memory object footprint improvements (MOD-16608)

### Modules API

- #15350 `RedisModuleEvent_ClusterTopologyChange` - cluster topology change

- #15327 `REDISMODULE_SUBEVENT_FORK_CHILD_*` - allow multi-threaded modules can quiesce background work before `fork()`

- #15373 `REDISMODULE_SUBEVENT_CLUSTER_SLOT_MIGRATION_MIGRATE_MODULE_PROPAGATE_END` - inject commands after ASM replication stream

- #15242 `RedisModule_AddPostNotificationJobForKey` - binds deferred work to a specific key from a keyspace-notification handler

### Configuration parameters

- #15364 Compact hashes:

- `hash-rdb-load-min-template-entries` - minimum field count to convert a plain hash to a template during load

- `hash-rdb-load-max-template-entries` - maximum field count for load-time conversion

- `hash-rdb-load-template-disassembly-threshold` - minimum number of keys a converted template must end up with to be kept

### Metrics

- #15364 Compact hashes:

- `INFO STATS` - `hash_templates` - number of distinct compact hash templates

- `INFO STATS` - `hash_template_keys` - total number of keys backed by a compact hash template

- `INFO MEMORY` - `used_memory_hash_templates` - total memory used by all compact hash templates

- `MEMORY STATS` - `hash.templates` - total memory used by all compact hash templates

- `MEMORY USAGE <key>` reports the key’s own + plus its share of a compact hash template cost

### CLI tools

- #15352 Adds `--latency-percentiles <p1,p2,...>` to `--latency` / `--latency-history`: reporting user-chosen percentiles

- #15262 `redis-cli --cluster rebalance` - CROSSSLOT error on when using `-user` without `-a`

- #15338 `redis-cli --cluster reshard` and `rebalance` now move slots with server-side atomic slot migration