CVE-2026-25588

RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisTimeSeries module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This has been patched in version 1.12.14.

(CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply

These are all security issues fixed in the redis-8.6.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for redis fixes the following issues:

Changes in redis:

• Update to 8.10.1

  Update urgency: SECURITY: There are security fixes in the release.

  • Security fixes
    • (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
    • Out-of-bounds access in TopK heap cleanup path (MOD-15410)
    • Use-after-free in the TLS pending-data list when a command closes another pending connection
    • A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
    • Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
    • Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
    • Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
    • TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
    • #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

• Restrict the "modules" flavour to x86_64 and aarch64 -- RedisBloom and RedisTimeSeries abort on anything else with "only supports 64-bit architectures (x64, arm64v8)", redisjson's vendored redis-module is 64-bit only, and modules/common.mk maps no other architecture at all

• Update to 8.10.0

  Major changes compared to 8.8

  • Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema
  • New command: HIMPORT - high-throughput compact hash bulk insertion
  • TLS peer certificate-based server-to-server authentication
  • New commands: LMOVEM, BLMOVEM - move multiple elements between lists
  • New command: SUNIONCARD - get the cardinality of the union of multiple sets
  • New command: SDIFFCARD - get the cardinality of the difference between sets
  • New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF)
  • XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
  • New command: FT.ALIASLIST - get all aliases for the index
  • Stemmer support for Malay and Tagalog languages
  • JSONPath extensions
  • New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp
  • New command: TS.READ - optionally blocking read
  • New command: TS.QUERYLABELS - Get a list of labels and label-values
  • New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples
  • Performance improvements

• Update to 8.8.1 Security fixes

  • RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution

• Update to 8.8.0

  • New data structure: Array (@antirez)
  • Subkey notification for hash fields - field-level notifications
  • INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)
  • XNACK: a new streams command - allow consumers to explicitly release pending messages
  • ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator
  • JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays
  • TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command
  • FT.HYBRID KNN clause: new argument to request fewer candidates per shard
  • FT.PROFILE HYBRID: profiling support for FT.HYBRID
  • Performance improvements

• Updated to 8.6.3 (boo#1264164 boo#1264165 boo#1264166…