{"id":"CVE-2026-25243","aliases":["ALPINE-CVE-2026-25243","ALSA-2026:23229","ALSA-2026:25216","ALSA-2026:25219","ALSA-2026:25925","ALSA-2026:26008","AZL-86081","BELL-CVE-2026-25243","BIT-keydb-2026-25243","BIT-redis-2026-25243","BIT-valkey-2026-25243","CLSA-2026-1778616298","CLSA-2026-1778845249","CLSA-2026-1788372462","DEBIAN-CVE-2026-25243","EUVD-2026-27410","GHSA-c8h9-259x-jff4","MGASA-2026-0134","OESA-2026-2237","RHSA-2026:14316","RHSA-2026:23229","RHSA-2026:25216","RHSA-2026:25219","RHSA-2026:25925","RHSA-2026:26008","RHSA-2026:26233","RHSA-2026:26306","RHSA-2026:26540","RHSA-2026:27716","RHSA-2026:27787","RHSA-2026:28139","RHSA-2026:28142","RHSA-2026:29817","RHSA-2026:33427","RLSA-2026:23229","RLSA-2026:25216","RLSA-2026:25219","RLSA-2026:25925","RLSA-2026:26008","SUSE-SU-2026:1949-1","SUSE-SU-2026:1950-1","SUSE-SU-2026:2097-1","SUSE-SU-2026:2098-1","SUSE-SU-2026:2099-1","SUSE-SU-2026:2100-1","SUSE-SU-2026:21814-1","UBUNTU-CVE-2026-25243","openSUSE-SU-2026:10711-1","openSUSE-SU-2026:10719-1","openSUSE-SU-2026:20776-1","openSUSE-SU-2026:21612-1"],"status":"published","title":"redis-server RESTORE invalid memory access may allow remote code execution","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.04033,"percentile":0.90676,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-122"],"published":"2026-05-05T16:44:57Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"dinosn/CVE-2026-25243","title":"dinosn/CVE-2026-25243","date":"2026-06-13","url":"https://github.com/dinosn/CVE-2026-25243"},{"source":"pocgithub","id":"dinosn/CVE-2026-25243-debugfree","title":"dinosn/CVE-2026-25243-debugfree","date":"2026-07-02","url":"https://github.com/dinosn/CVE-2026-25243-debugfree"},{"source":"pocgithub","id":"captain-woof/CVE-2026-25243","title":"captain-woof/CVE-2026-25243","date":"2026-08-06","url":"https://github.com/captain-woof/CVE-2026-25243"}],"fixes":[{"ecosystem":"Alpine:v3.20","package":"valkey","fixed_in":["7.2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"valkey","fixed_in":["7.2.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"valkey","fixed_in":["8.1.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"valkey","fixed_in":["9.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"valkey","fixed_in":["9.0.4-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"redis","fixed_in":["6.2.22-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"redis-devel","fixed_in":["6.2.22-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"redis-doc","fixed_in":["6.2.22-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"redis","fixed_in":["6.2.22-1.module_el8.10.0+4197+3446deec"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"redis-devel","fixed_in":["6.2.22-1.module_el8.10.0+4197+3446deec"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"redis-doc","fixed_in":["6.2.22-1.module_el8.10.0+4197+3446deec"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"valkey","fixed_in":["8.0.9-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"redis","fixed_in":["7.2.14-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"valkey","fixed_in":["8.1.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"valkey","fixed_in":["9.0.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"keydb","fixed_in":["6.2.22","7.2.14","7.4.9","8.2.6","8.4.3","8.6.3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"redis","fixed_in":["6.2.22","7.2.14","7.4.9","8.2.6","8.4.3","8.6.3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"valkey","fixed_in":["7.2.13","8.0.8","8.1.7","9.0.4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"redis","fixed_in":["5:7.0.15-1~deb12u8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"redis","fixed_in":["5:8.0.2-3+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"redis","fixed_in":["5:8.0.6-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"valkey","fixed_in":["8.1.1+dfsg1-3+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"valkey","fixed_in":["9.1.1-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis","fixed_in":["0:6.2.22-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debuginfo","fixed_in":["0:6.2.22-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debugsource","fixed_in":["0:6.2.22-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-devel","fixed_in":["0:6.2.22-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-doc","fixed_in":["0:6.2.22-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis","fixed_in":["0:6.2.22-1.module+el8.10.0+24332+dbd3b426"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-debuginfo","fixed_in":["0:6.2.22-1.module+el8.10.0+24332+dbd3b426"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-debugsource","fixed_in":["0:6.2.22-1.module+el8.10.0+24332+dbd3b426"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-devel","fixed_in":["0:6.2.22-1.module+el8.10.0+24332+dbd3b426"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-doc","fixed_in":["0:6.2.22-1.module+el8.10.0+24332+dbd3b426"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis","fixed_in":["0:6.2.22-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-debuginfo","fixed_in":["0:6.2.22-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-debugsource","fixed_in":["0:6.2.22-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-devel","fixed_in":["0:6.2.22-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-doc","fixed_in":["0:6.2.22-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis","fixed_in":["0:6.2.7-1.el9_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis-debuginfo","fixed_in":["0:6.2.7-1.el9_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis-debugsource","fixed_in":["0:6.2.7-1.el9_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis-devel","fixed_in":["0:6.2.7-1.el9_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis-doc","fixed_in":["0:6.2.7-1.el9_2.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis-debuginfo","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis-debugsource","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis-devel","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis-doc","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis-debuginfo","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis-debugsource","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis-devel","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis-doc","fixed_in":["0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis","fixed_in":["0:6.2.7-1.el9_4.6","0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-debuginfo","fixed_in":["0:6.2.7-1.el9_4.6","0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-debugsource","fixed_in":["0:6.2.7-1.el9_4.6","0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-devel","fixed_in":["0:6.2.7-1.el9_4.6","0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-doc","fixed_in":["0:6.2.7-1.el9_4.6","0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis-debuginfo","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis-debugsource","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis-devel","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis-doc","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis-debuginfo","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis-debugsource","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis-devel","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis-doc","fixed_in":["0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis-debuginfo","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis-debugsource","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis-devel","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis-doc","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis-debuginfo","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis-debugsource","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis-devel","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis-doc","fixed_in":["0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"redis","fixed_in":["0:6.2.22-1.el9_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"redis","fixed_in":["0:6.2.22-1.module+el8.10.0+40211+0d1d5c90"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.22-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.22-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.22-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.9-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"valkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.9-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-1.module_el9.8.0+258+b8f945d3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-1.module_el9.8.0+258+b8f945d3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-1.module_el9.8.0+258+b8f945d3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.9-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"valkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.9-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.22-1.module_el8.10.0+4197+3446deec"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.22-1.module_el8.10.0+4197+3446deec"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.22-1.module_el8.10.0+4197+3446deec"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.9-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.9-r0"},{"fixed":"7.2.14-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.6-r0"},{"fixed":"8.1.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.3-r0"},{"fixed":"9.0.4-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"keydb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.2.22"},{"introduced":"7.0.0"},{"fixed":"7.2.14"},{"introduced":"7.3.0"},{"fixed":"7.4.9"},{"introduced":"8.0.0"},{"fixed":"8.2.6"},{"introduced":"8.3.0"},{"fixed":"8.4.3"},{"introduced":"8.5.0"},{"fixed":"8.6.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"redis","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.2.22"},{"introduced":"7.0.0"},{"fixed":"7.2.14"},{"introduced":"7.3.0"},{"fixed":"7.4.9"},{"introduced":"8.0.0"},{"fixed":"8.2.6"},{"introduced":"8.3.0"},{"fixed":"8.4.3"},{"introduced":"8.5.0"},{"fixed":"8.6.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"valkey","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.2.13"},{"introduced":"8.0.0"},{"fixed":"8.0.8"},{"introduced":"8.1.0"},{"fixed":"8.1.7"},{"introduced":"9.0.0"},{"fixed":"9.0.4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.20-1.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.20-1.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.20-1.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.21-1.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.21-1.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.21-1.el9_2.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.14-1+deb10u5+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"redis-sentinel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.14-1+deb10u5+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"redis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.14-1+deb10u5+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"redis-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.0.14-1+deb10u5+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:14","package":"redict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+ds-1","7.3.0+ds-2","7.3.0+ds-3","7.3.0+ds-3~bpo12+1","7.3.1+ds-1","7.3.2+ds-1","7.3.2+ds-1~bpo12+1","7.3.5+ds-1","7.3.5+ds-1~bpo12+1","7.3.6+ds-1","7.3.6+ds-1~bpo12+1","7.3.6+ds-1~bpo13+1","7.3.6+ds-2","7.3.6+ds-2~bpo12+1","7.3.6+ds-2~bpo13+1","7.3.6+ds-3"]},{"source":"osv","ecosystem":"Debian:12","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:7.0.15-1~deb12u8"}]}],"versions":["5:7.0.11-1","5:7.0.11-1+deb12u1","5:7.0.12-1","5:7.0.12-2","5:7.0.13-1","5:7.0.13-2","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1~deb12u1","5:7.0.15-1~deb12u2","5:7.0.15-1~deb12u3","5:7.0.15-1~deb12u4","5:7.0.15-1~deb12u5","5:7.0.15-1~deb12u6","5:7.0.15-1~deb12u7"]},{"source":"osv","ecosystem":"Debian:13","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:8.0.2-3+deb13u3"}]}],"versions":["5:8.0.2-3","5:8.0.2-3+deb13u1","5:8.0.2-3+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:8.0.6-3"}]}],"versions":["5:8.0.2-3","5:8.0.4-1","5:8.0.5-1","5:8.0.6-1","5:8.0.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1+dfsg1-3+deb13u3"}]}],"versions":["8.1.1+dfsg1-3","8.1.1+dfsg1-3+deb13u1","8.1.1+dfsg1-3+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1-1"}]}],"versions":["8.1.1+dfsg1-3","8.1.4+dfsg1-1","8.1.4+dfsg1-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-1.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-1.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-1.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-1.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.14-1.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.4-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"valkey-compat-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.4-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"valkey-compat-redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.4-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"valkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.4-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"valkey-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.4-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"valkey-rdma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.4-0.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"valkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"valkey-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"valkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.8.0+24327+41ceb644"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.8.0+24327+41ceb644"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.8.0+24327+41ceb644"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.8.0+24327+41ceb644"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.8.0+24327+41ceb644"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"valkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"valkey-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"valkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.module+el8.10.0+24332+dbd3b426"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.module+el8.10.0+24332+dbd3b426"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.module+el8.10.0+24332+dbd3b426"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.module+el8.10.0+24332+dbd3b426"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.module+el8.10.0+24332+dbd3b426"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.6.0+24344+1bc33ec7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.6.0+24344+1bc33ec7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.6.0+24344+1bc33ec7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.6.0+24344+1bc33ec7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.6.0+24344+1bc33ec7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"valkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"valkey-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"valkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_2.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.el9_4.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"redis-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.el9_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.2.14-1.module+el9.8.0+40207+e2014501"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.9-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.22-1.module+el8.10.0+40211+0d1d5c90"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.6.13-1","2:2.6.16-3","2:2.8.0-1","2:2.8.2-1","2:2.8.4-2","2:2.8.4-2ubuntu0.2","2:2.8.4-2ubuntu0.2+esm1","2:2.8.4-2ubuntu0.2+esm2","2:2.8.4-2ubuntu0.2+esm3","2:2.8.4-2ubuntu0.2+esm4","2:2.8.4-2ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.0.3-3","2:3.0.5-1","2:3.0.5-2","2:3.0.5-3","2:3.0.5-4","2:3.0.6-1","2:3.0.6-1ubuntu0.2","2:3.0.6-1ubuntu0.3","2:3.0.6-1ubuntu0.4","2:3.0.6-1ubuntu0.4+esm1","2:3.0.6-1ubuntu0.4+esm2","2:3.0.6-1ubuntu0.4+esm3","2:3.0.6-1ubuntu0.4+esm4","2:3.0.6-1ubuntu0.4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.0.1-7","4:4.0.2-6","4:4.0.2-9","5:4.0.5-1","5:4.0.6-1","5:4.0.6-2","5:4.0.7-1","5:4.0.8-1","5:4.0.8-2","5:4.0.9-1","5:4.0.9-1ubuntu0.1","5:4.0.9-1ubuntu0.2","5:4.0.9-1ubuntu0.2+esm2","5:4.0.9-1ubuntu0.2+esm3","5:4.0.9-1ubuntu0.2+esm4","5:4.0.9-1ubuntu0.2+esm5","5:4.0.9-1ubuntu0.2+esm6","5:4.0.9-1ubuntu0.2+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5:5.0.5-2build1","5:5.0.6-1","5:5.0.7-1","5:5.0.7-2","5:5.0.7-2ubuntu0.1~esm1","5:5.0.7-2ubuntu0.1","5:5.0.7-2ubuntu0.1+esm1","5:5.0.7-2ubuntu0.1+esm2","5:5.0.7-2ubuntu0.1+esm3","5:5.0.7-2ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5:6.0.15-1","5:6.0.16-1","5:6.0.16-1build1","5:6.0.16-1ubuntu1","5:6.0.16-1ubuntu1+esm1","5:6.0.16-1ubuntu1+esm2","5:6.0.16-1ubuntu1.1","5:6.0.16-1ubuntu1.1+esm1","5:6.0.16-1ubuntu1.2","5:6.0.16-1ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5:7.0.12-1","5:7.0.14-1","5:7.0.14-2","5:7.0.15-1","5:7.0.15-1build1","5:7.0.15-1build2","5:7.0.15-1ubuntu0.24.04.1","5:7.0.15-1ubuntu0.24.04.2","5:7.0.15-1ubuntu0.24.04.3","5:7.0.15-1ubuntu0.24.04.4","5:7.0.15-1ubuntu0.24.04.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5:7.0.15-3","5:7.0.15-3.1","5:8.0.2-3","5:8.0.2-3build1","5:8.0.2-3ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5:8.0.5-1","5:8.0.6-2","5:8.0.6-2build1","5:8.0.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5:8.0.2-3build1","5:8.0.2-3ubuntu0.25.10.1","5:8.0.5-1","5:8.0.5-1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.3-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"valkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.4-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.1-bp160.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"redis-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.1-bp160.1.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"redis","product":"redis"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","article"]},{"url":"https://github.com/redis/redis/releases/tag/8.6.3","tags":["x_refsource_MISC","Release Notes","article","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25243","tags":["vdb-entry","x_refsource_REDHAT","report","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466828","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25243.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26540","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25216","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26008","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27787","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29817","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33427","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27716","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28139","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28142","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26233","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26306","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23229","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25219","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25925","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14316","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-25243","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2466828","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-23229.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23479","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23631","tags":["report"]},{"url":"https://bugzilla.redhat.com/2466780","tags":["report"]},{"url":"https://bugzilla.redhat.com/2466788","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-25216.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-25219.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-25925.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-26008.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25243","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-25243","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778616298.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778845249.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1788372462.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66373","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25243.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25243","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0134.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35514","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/CVOEZ7I2TIPXYBFA4UYY5GI5Q4VOAD7C/","tags":["web"]},{"url":"https://github.com/redis/redis/releases/tag/7.2.13","tags":["web"]},{"url":"https://github.com/redis/redis/releases/tag/7.2.14","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23631","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14316.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466780","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23479","tags":["advisory"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23631","tags":["advisory"]},{"url":"https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25243","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23229.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25216.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25219.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25925.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26008.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26233.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26306.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26540.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27716.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27787.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28139.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28142.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29817.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33427.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:23229","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25216","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25219","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25925","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:26008","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261949-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264164","tags":["report"]},{"url":"https://bugzilla.suse.com/1264165","tags":["report"]},{"url":"https://bugzilla.suse.com/1264166","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25243","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261950-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262097-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258706","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262098-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262099-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262100-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621814-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258746","tags":["report"]},{"url":"https://bugzilla.suse.com/1258788","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21863","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-25243","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25589","tags":["web"]},{"url":"https://bugzilla.suse.com/1260399","tags":["report"]},{"url":"https://bugzilla.suse.com/1264167","tags":["report"]},{"url":"https://bugzilla.suse.com/1264168","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62356","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-25243","title":"redis-server RESTORE invalid memory access may allow remote code execution","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-05T16:44:57.306Z","modified":"2026-07-16T12:04:33.393Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-122","CWE-122"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-27410","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-05T16:44:57Z","modified":"2026-07-16T12:04:33Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:19:52.35951Z"}],"nvd":[{"id":"CVE-2026-25243","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-05T17:17:03.667Z","modified":"2026-07-25T11:10:00.1Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:17.022502Z"}],"osv":[{"id":"ALPINE-CVE-2026-25243","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-05T17:17:03.667Z","modified":"2026-10-01T02:17:49.215424691Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-25243","status":"published","published":"2026-05-07T06:10:19.934422Z","modified":"2026-05-11T07:15:32.226427Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"CVE-2026-25243","title":"redis-server RESTORE invalid memory access may allow remote code execution","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-05T16:44:57.306Z","modified":"2026-10-28T02:30:42.440577576Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"DEBIAN-CVE-2026-25243","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-05T17:17:03.667Z","modified":"2026-10-27T05:00:07.777162402Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"OESA-2026-2237","title":"redis security update","description":"Redis is an advanced key-value store. It is often referred to as a dattructure server since keys can contain strings, hashes ,lists, sets anorted sets.\r\n\r\nSecurity Fix(es):\n\nWhen a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.\n\nThe problem exists in Redis `7.2` or newer.(CVE-2026-23479)\n\nAn authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution. The bug affects only replicas that are configured, or may be configured with `replica-read-only` disabled, and exists in all versions of Redis with Lua scripting.(CVE-2026-23631)\n\nA vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution. Successful exploitation could allow an attacker with authenticated access to execute arbitrary code in the context of the Redis server, potentially leading to full compromise of the affected system, data exfiltration, or service disruption. This problem affects all Redis versions.(CVE-2026-25243)","status":"published","published":"2026-05-09T11:11:13Z","modified":"2026-08-18T01:19:53.099967004Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:14316","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-16T10:04:18Z","modified":"2026-10-07T10:06:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:23229","title":"Red Hat Security Advisory: redis security update","status":"published","published":"2026-06-05T10:06:25Z","modified":"2026-07-16T10:06:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:25216","title":"Red Hat Security Advisory: valkey security update","status":"published","published":"2026-06-12T10:07:01Z","modified":"2026-10-07T10:08:28Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25219","title":"Red Hat Security Advisory: redis:7 security update","status":"published","published":"2026-06-12T10:07:04Z","modified":"2026-10-07T10:08:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25925","title":"Red Hat Security Advisory: valkey security update","status":"published","published":"2026-06-16T10:06:23Z","modified":"2026-10-07T10:08:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:26008","title":"Red Hat Security Advisory: redis:6 security update","status":"published","published":"2026-06-16T10:06:27Z","modified":"2026-07-16T10:06:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:26233","title":"Red Hat Security Advisory: redis security update","status":"published","published":"2026-06-17T10:08:38Z","modified":"2026-07-16T10:06:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:26306","title":"Red Hat Security Advisory: redis:7 security update","status":"published","published":"2026-06-17T10:08:42Z","modified":"2026-10-07T10:08:40Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:26540","title":"Red Hat Security Advisory: valkey security update","status":"published","published":"2026-06-18T10:09:51Z","modified":"2026-10-07T10:08:46Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:27716","title":"Red Hat Security Advisory: redis security update","status":"published","published":"2026-06-22T10:06:37Z","modified":"2026-07-16T10:07:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:27787","title":"Red Hat Security Advisory: redis:6 security update","status":"published","published":"2026-06-22T10:06:54Z","modified":"2026-07-16T10:07:26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:28139","title":"Red Hat Security Advisory: redis security update","status":"published","published":"2026-06-23T10:08:30Z","modified":"2026-07-16T10:07:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:28142","title":"Red Hat Security Advisory: redis:7 security update","status":"published","published":"2026-06-23T10:08:30Z","modified":"2026-07-16T10:07:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:29817","title":"Red Hat Security Advisory: redis:6 security update","status":"published","published":"2026-06-26T11:46:30Z","modified":"2026-07-16T10:07:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:33427","title":"Red Hat Security Advisory: redis:6 security update","status":"published","published":"2026-06-30T10:49:48Z","modified":"2026-07-16T10:08:24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RLSA-2026:23229","title":"Important: redis security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-11T12:03:24.031456Z","modified":"2026-06-11T12:30:16.116569805Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:25216","title":"Important: valkey security update","description":"Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.\n\nSecurity Fix(es):\n\n* redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)\n\n* redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)\n\n* redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-13T00:05:06.020189Z","modified":"2026-06-13T00:30:05.71451118Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:25219","title":"Important: redis:7 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)\n\n* redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)\n\n* redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-13T00:03:17.085789Z","modified":"2026-06-13T00:30:04.736960712Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:25925","title":"Important: valkey security update","description":"Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.\n\nSecurity Fix(es):\n\n* redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)\n\n* redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)\n\n* redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-17T12:03:08.073041Z","modified":"2026-06-17T12:30:04.64639496Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:26008","title":"Important: redis:6 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.\n\nSecurity Fix(es):\n\n* redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-17T06:00:26.379988Z","modified":"2026-06-17T06:30:05.843287115Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-25243","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-05T17:17:00Z","modified":"2026-10-17T12:58:07.51920634Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"ALSA-2026:23229","title":"Important: redis security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.  \n\nSecurity Fix(es):  \n\n  * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-04T00:00:00Z","modified":"2026-10-29T11:32:33.916782952Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:25216","title":"Important: valkey security update","description":"Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.  \n\nSecurity Fix(es):  \n\n  * redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)\n  * redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)\n  * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-10-29T11:30:20.917568417Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:25219","title":"Important: redis:7 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.  \n\nSecurity Fix(es):  \n\n  * redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)\n  * redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)\n  * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-10-29T11:32:31.38567805Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:25925","title":"Important: valkey security update","description":"Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also.  \n\nSecurity Fix(es):  \n\n  * redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)\n  * redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)\n  * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-15T00:00:00Z","modified":"2026-10-29T11:32:34.031998672Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:26008","title":"Important: redis:6 security update","description":"Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log.  \n\nSecurity Fix(es):  \n\n  * redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-15T00:00:00Z","modified":"2026-10-29T11:02:23.976946742Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"AZL-86081","title":"CVE-2026-25243 affecting package valkey for versions less than 8.0.9-1","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-05T17:17:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"BIT-keydb-2026-25243","title":"redis-server RESTORE invalid memory access may allow remote code execution","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-07T11:43:05.71Z","modified":"2026-09-08T08:48:07.515428194Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-redis-2026-25243","title":"redis-server RESTORE invalid memory access may allow remote code execution","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-07T11:51:17.557Z","modified":"2026-09-08T08:48:19.199875473Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"BIT-valkey-2026-25243","title":"redis-server RESTORE invalid memory access may allow remote code execution","description":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","status":"published","published":"2026-05-07T11:52:00.374Z","modified":"2026-09-08T08:48:21.308240555Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2026-1778616298","title":"redis: Fix of 2 CVEs","description":"- CVE-2026-23631: use-after-free in readSyncBulkPayload when a full resync\n  happens while a timed-out script is still running on the replica\n- CVE-2026-25243: heap corruption and out-of-bounds reads in the RESTORE\n  command deserialization path (rdb.c, sds.c, zipmap.c)","status":"published","published":"2026-05-12T20:05:04Z","modified":"2026-06-01T00:32:52.227501845Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778845249","title":"redis: Fix of 2 CVEs","description":"- CVE-2026-23631: fix use-after-free in readSyncBulkPayload when fullsync happens\n  while a Lua script is timed out on the replica\n- CVE-2026-25243: fix invalid memory access in RESTORE on crafted zipmap, listpack\n  and stream PEL payloads","status":"published","published":"2026-05-15T12:19:27Z","modified":"2026-06-01T00:32:30.981103689Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1788372462","title":"Fix CVE(s): CVE-2025-21605, CVE-2025-48367, CVE-2026-66373","description":"   * SECURITY UPDATE: Memory exhaustion via unauthenticated client output buffer\n     - debian/patches/0016-CVE-2025-21605.patch: cap the output buffer of\n       unauthenticated clients in checkClientOutputBufferLimits() in\n       src/networking.c, so a client that never reads its NOAUTH replies\n       cannot grow the buffer without bound. Backport of upstream redis\n       commit 5e93f9cb9 (6.2.18) as shipped by Debian for bullseye in\n       5:6.0.16-1+deb11u9 (DLA-4162-1), adapted to 5.0 by spelling the\n       condition as server.requirepass \u0026\u0026 !c-\u003eauthenticated, since 5.0\n       predates the ACL subsystem and has no authRequired() helper.\n     - CVE-2025-21605\n   * SECURITY UPDATE: Client starvation via repeated accept() errors\n     - debian/patches/0017-CVE-2025-48367.patch: add\n       anetAcceptFailureNeedsRetry() to src/anet.c and retry the accept\n       loop in acceptTcpHandler()/acceptUnixHandler() in src/networking.c\n       and clusterAcceptHandler() in src/cluster.c, so a connection that\n       fails at accept() time no longer aborts the whole batch and starves\n       other pending clients. Backport of upstream redis commit 0fe674359\n       (6.2.19) as shipped by Debian for bullseye in 5:6.0.16-1+deb11u9\n       (DLA-4240-1); the acceptTLSHandler() hunk is dropped because 5.0\n       has no TLS support.\n     - CVE-2025-48367\n   * SECURITY UPDATE: Double free via stream RDB payload with a shared NACK\n     - debian/patches/0018-CVE-2026-66373.patch: reject a stream payload\n       whose consumer PELs reference the same global-PEL NACK twice, in\n       rdbLoadObject() in src/rdb.c, so RESTORE can no longer build two\n       consumers sharing one streamNACK and have XGROUP DELCONSUMER free\n       it twice. Backport of upstream redis commit 41a958720 (6.2.23) as\n       shipped by Debian for bullseye and bookworm in 5:6.0.16-1+deb11u9\n       and 5:7.0.15-1~deb12u9 (DLA-4722-1), taken verbatim in the Debian\n       form that uses rdbExitReportCorruptRDB(). Note this CVE exists\n       because of an incomplete fix for CVE-2026-25243, which is a\n       separate change and is not addressed here.\n     - CVE-2026-66373","status":"published","published":"2026-09-02T18:07:54Z","modified":"2026-10-26T09:43:18.682215829Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"MGASA-2026-0134","title":"Updated redis packages fix security vulnerabilities","description":"(CVE-2026-23479) Use-After-Free in unblock client flow may lead to\nRemote Code Execution.\n(CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote\nCode Execution\n(CVE-2026-23631) Lua Use-After-Free may lead to remote code execution\nA user can manipulate data read by a connection by injecting \\r\\n\nsequences into a Redis error reply\n","status":"published","published":"2026-05-14T02:43:25Z","modified":"2026-05-14T02:45:27.416872Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10711-1","title":"redis-8.6.3-1.1 on GA media","description":"These are all security issues fixed in the redis-8.6.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-06T00:00:00Z","modified":"2026-05-07T08:47:57.552207Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10719-1","title":"valkey-9.0.4-1.1 on GA media","description":"These are all security issues fixed in the valkey-9.0.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-07T00:00:00Z","modified":"2026-05-08T08:16:13.530898Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20776-1","title":"Security update for valkey","description":"This update for valkey fixes the following issues\n\n- CVE-2025-67733: data tampering and denial of service via improper null character handling in Lua scripts\n  (bsc#1258746).\n- CVE-2026-21863: denial of service via invalid clusterbus packet (bsc#1258788).\n- CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).\n- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution\n  (bsc#1264165).\n- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote\n  code execution (bsc#1264166).\n\nChanges for valkey:\n\n  - Update to 8.0.9.\n\n  - Update to 8.0.7:\n\n   * Fix ltrim should not call signalModifiedKey when no elements are removed (#2787)\n   * Fix chained replica crash when doing dual channel replication (#2983)\n   * Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)\n   * Avoids crash during MODULE UNLOAD when ACL rules reference a module command and\n     subcommand (#3160)\n   * Fix server assert on ACL LOAD and resetchannels (#3182)\n   * Fix bug causing no response flush sometimes when IO threads are busy (#3205)\n","status":"published","published":"2026-05-18T10:01:17Z","modified":"2026-05-26T18:24:12.550803986Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21612-1","title":"Security update for redis","description":"This update for redis fixes the following issues:\n\nChanges in redis:\n\n- Update to 8.10.1\n\n  Update urgency: SECURITY: There are security fixes in the release.\n\n  - Security fixes\n    - (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB\n      loading may lead to heap OOB write\n    - Out-of-bounds access in TopK heap cleanup path (MOD-15410)\n    - Use-after-free in the TLS pending-data list when a command\n      closes another pending connection\n    - A malicious RDB payload with an out-of-range SLOT_INFO slot\n      id causes memory corruption during RDB loading, which may\n      lead to Remote Code Execution\n    - Vector Sets: missing node level validation when loading a\n      vector set from RDB may lead to out-of-bounds access\n    - Vector Sets: use-after-free when VREM mutates the HNSW graph\n      while background VSIM threads are still running\n    - Vector Sets: a negative hnsw_search() return was treated as a\n      huge unsigned count, reading past the end of the result\n      arrays\n    - TLS client certificate authentication bypass: a Common Name\n      containing an embedded NUL byte was truncated, allowing a\n      client to authenticate as another (possibly privileged) ACL\n      user\n    - #15594 Use-after-free in the blocked-client list when\n      reprocessing a command evicts another client blocked on the\n      same key\n\n- Restrict the \"modules\" flavour to x86_64 and aarch64 -- RedisBloom and\n  RedisTimeSeries abort on anything else with \"only supports 64-bit\n  architectures (x64, arm64v8)\", redisjson's vendored redis-module is\n  64-bit only, and modules/common.mk maps no other architecture at all\n\n- Update to 8.10.0\n\n  Major changes compared to 8.8\n  - Compact hashes - a new hash encoding that reduces memory usage\n    by storing hash field names just once for keys that share a\n    schema\n  - New command: HIMPORT - high-throughput compact hash bulk\n    insertion\n  - TLS peer certificate-based server-to-server authentication\n  - New commands: LMOVEM, BLMOVEM - move multiple elements between\n    lists\n  - New command: SUNIONCARD - get the cardinality of the union of\n    multiple sets\n  - New command: SDIFFCARD - get the cardinality of the difference\n    between sets\n  - New command: BACKUP - node-side implementation for backup and\n    restore based on multi-part AOF (MP-AOF)\n  - XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap\n    the cumulative reply entries and size\n  - New command: FT.ALIASLIST - get all aliases for the index\n  - Stemmer support for Malay and Tagalog languages\n  - JSONPath extensions\n  - New commands: TS.NRANGE, TS.NREVRANGE - Query a range across\n    multiple time series; group results by timestamp\n  - New command: TS.READ - optionally blocking read\n  - New command: TS.QUERYLABELS - Get a list of labels and\n    label-values\n  - New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY\n    argument to exclude series with no reported samples\n  - Performance improvements\n\n- Update to 8.8.1\n  Security fixes\n  - RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in\n    RedisBloom and TDigest may trigger out-of-bounds writes,\n    potentially leading to remote code execution\n\n- Update to 8.8.0\n  - New data structure: Array (@antirez)\n  - Subkey notification for hash fields - field-level notifications\n  - INCREX: a window counter rate limiter combining INCR, INCRBY,\n    INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)\n  - XNACK: a new streams command - allow consumers to explicitly\n    release pending messages\n  - ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator\n  - JSON.SET: new FPHA argument to specify the FP type for\n    homogeneous FP arrays\n  - TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple\n    aggregators in a single command\n  - FT.HYBRID KNN clause: new argument to request fewer candidates\n    per shard\n  - FT.PROFILE HYBRID: profiling support for FT.HYBRID\n  - Performance improvements\n\n- Updated to 8.6.3 (boo#1264164 boo#1264165 boo#1264166 boo#1264167 boo#1264168)\n  - Security fixes\n    - (CVE-2026-23479) Use-After-Free in unblock client flow may\n      lead to Remote Code Execution.\n    - (CVE-2026-25243) Invalid memory access in RESTORE may lead to\n      Remote Code Execution\n    - (CVE-2026-23631) Lua Use-After-Free may lead to remote code\n      execution\n    - (CVE-2026-25588) Invalid memory access in RESTORE may lead to\n      Remote Code Execution (Time Series)\n    - (CVE-2026-25589) Invalid memory access in RESTORE may lead to\n      Remote Code Execution (Probabilistic)\n  - Bug fixes\n    - SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)\n    - CONFIG SET: some settings allow invalid characters\n      (RED-167787)\n    - SCRIPT DEBUG: potential crash on scripts (RED-175507)\n    - VADD: crash or buffer overflow on large REDUCE value\n      (RED-170921)\n    - VSET: crash on huge allocations (MOD-12678)\n    - Potential crash on disconnections and TLS failures (Time\n      Series) (MOD-14850)\n    - RediSearch/RediSearch#8745 Crash when many keys receive\n      expirations under heavy TTL activity (MOD-14500)\n    - RediSearch/RediSearch#8848 HNSW vector index memory growth\n      under high-churn workloads until shard restart (MOD-13761)\n    - RediSearch/RediSearch#8205, RediSearch/RediSearch#8259\n      FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero\n      results (MOD-12370, MOD-13884)\n    - RediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty\n      reply (MOD-14778)\n    - RediSearch/RediSearch#8129, RediSearch/RediSearch#8140\n      FT.PROFILE reports an incorrect shard total profile time\n      (MOD-13735, MOD-13181)\n    - RediSearch/RediSearch#9047 FT.PROFILE output is inconsistent\n      when a profiled value is missing (MOD-10560)\n    - RediSearch/RediSearch#8791 FT.EXPLAIN does not lock, causing\n      a race with concurrent index changes (MOD-14461)\n    - RediSearch/RediSearch#8382 Crash when indexing negative zero\n      (-0.0) (MOD-13904)\n    - RediSearch/RediSearch#8590 FILTER returns inconsistent\n      results with multiple indexes sharing field aliases\n      (MOD-14063)\n    - RediSearch/RediSearch#8660 FILTER behavior depends on\n      property order in the expression (MOD-14065)\n    - RediSearch/RediSearch#8593 Filter expressions are evaluated\n      for indexes that do not match the document type (MOD-14064)\n    - RediSearch/RediSearch#8591 Documents are inconsistently\n      included or excluded depending on the indexing path taken\n      (MOD-13948)\n    - RediSearch/RediSearch#8589 RENAME notification handler loads\n      the wrong key, causing stale index entries after a rename\n      (MOD-14328)\n    - RediSearch/RediSearch#9012 PERSIST and HPERSIST notifications\n      are not reflected in index expiration tracking (MOD-14800)\n    - RediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS\n      placeholders as literal terms instead of resolving them\n      (MOD-10596)\n    - RediSearch/RediSearch#8462 GC out-of-memory on replica shards\n      leaves the replica in an inconsistent state (MOD-14066)\n    - RediSearch/RediSearch#9066 Race condition in FT.HYBRID causes\n      intermittent failures under concurrent hybrid query load\n      (MOD-14732)\n    - RediSearch/RediSearch#8109, RediSearch/RediSearch#8149\n      Configuration registration omits module parameters, causing\n      them to be unexposed or misapplied (RED-171841)\n    - RediSearch/RediSearch#9163 Crash on FT.SEARCH when topology\n      validation fails (for example, some nodes unreachable)\n      (MOD-14475)\n    - RediSearch/RediSearch#8395 FT.SEARCH fails with \"Query\n      requires unavailable slots\" after shard restart or failover\n      (MOD-13828)\n    - RediSearch/RediSearch#8451 FT.INFO-style output no longer\n      reports zero-index summary data when no indices exist\n      (MOD-14079)\n    - RediSearch/RediSearch#9078 FT.CREATE now rejects schema\n      definitions with invalid option combinations at creation time\n      (MOD-14655)\n    - RediSearch/RediSearch#8051, RediSearch/RediSearch#8114 Crash\n      diagnostics now include the IndexSpec of the index the\n      failing thread was working on (MOD-7574)\n  - Metrics\n    - RediSearch/RediSearch#8210, RediSearch/RediSearch#8231\n      FT.PROFILE: added queue time tracking (MOD-13602)\n\n- Updated to 8.6.2 (boo#1260399)\n  * Fixed potential UAF: don't use reply copy avoidance for module strings.\n  * Fixed crash during command processing on replicas performing.\n    full synchronization.\n  * Fixed potential Memory leaks.\n  * Fixed potential crash during ACL checks on wrong-arity commands.\n  * Fixed HSETEX HGETEX do not validate that FIELDS is specified only once.\n\n- Updated to 8.6.1 (boo#1258706)\n  * Fixed user can manipulate data read by a connection by\n    injecting \\r\\n sequences into a Redis error reply.\n  * Fixed INFO command may display module information,\n    and the missing HOTKEYS HELP subcommand has been added.\n  * Fixed RDB loading prevented hash table expansion.\n\n- Updated to 8.6.0\n\n  Major changes compared to 8.4\n  - Substantial performance improvements\n  - Substantial memory reduction for hashes (hashtable-encoded) and\n    sorted sets (skiplist-encoded)\n  - Streams: XADD idempotency (at-most-once guarantee) with new\n    IDMPAUTO and IDMP arguments\n  - New eviction policies - least recently modified: volatile-lrm\n    and allkeys-lrm\n  - Hot keys detection and reporting; new command: HOTKEYS\n  - TLS certificate-based automatic client authentication\n  - Time series: support NaN values; new aggregators: COUNTNAN and\n    COUNTALL\n\n  New Features\n  - #14695 Keys memory size histograms\n  - #14615 Streams: XADD idempotency (at-most-once guarantee) with\n    new IDMPAUTO and IDMP arguments\n  - #14624 New eviction policies - least recently modified:\n    volatile-lrm and allkeys-lrm\n  - #14680 Hot keys detection and reporting; new command: HOTKEYS\n  - #14610 TLS certificate-based automatic client authentication\n  - RedisTimeSeries/RedisTimeSeries#1853 Time series: support NaN\n    values; new aggregators: COUNTNAN and COUNTALL Security and\n    privacy fixes\n  - #14645 Hide Personally Identifiable Information from ACL log\n  - #14659 ACL: Key-pattern bypass in MSETEX\n  - RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474\n    Hide Personally Identifiable Information from server log\n  - RedisBloom/RedisBloom#950 Out-of-bounds read when loading an\n    invalid RDB file (MOD-12802) Bugfixes\n  - #14545 ACL: AOF loading fails if ACL rules are changed and\n    don't allow some commands in MULTI-EXEC\n  - #14637 Atomic slot migration: wrong adjacent slot range\n    behavior\n  - #14567 Atomic slot migration: support delay trimming slots\n    after finishing migrating slots\n  - #14623 Streams: XTRIM/XADD with approx mode (~) don’t delete\n    entries for DELREF/ACKED strategies\n  - #14552 Streams: Incorrect behavior when using\n    XDELEX...ACKEDafterXGROUP DESTROY`\n  - #14537 SCAN: restore original filter order (revert change\n    introduced in 8.2)\n  - #14581 Rare server hang at shutdown\n  - #14597 Panic when cluster node is uninitialized\n  - #14583 FLUSHALL ASYNC on a writable replica may block the main\n    thread for an extended period\n  - #14504 Cluster: fix race condition in broadcast configuration\n  - #14416 Fixed argument position handling in Redis APIs\n  - RedisTimeSeries/RedisTimeSeries#1784,\n    RedisTimeSeries/RedisTimeSeries#1839,\n    RedisBloom/RedisBloom#952, RedisJSON/RedisJSON#1477 Atomic slot\n    migration support\n  - RedisBloom/RedisBloom#946 MEMORY USAGE: fix reported value\n    (MOD-12799)\n  - RedisJSON/RedisJSON#1473 Adding escapes to already-escaped\n    characters (MOD-8137)\n  - RedisJSON/RedisJSON#1475 JSON.CLEAR does not error if more than\n    one path is specified (MOD-13109) Performance and resource\n    utilization improvements\n  - #14608 Reply copy-avoidance path to reduce memory copies for\n    bulk string replies\n  - #14595 Hash: unify field name and value into a single struct\n  - #14701 Sorted set: unify score and value into a single struct\n  - #14662 Optimize listpack iterator on hash fields\n  - #14699 Optimize set commands with expiration\n  - #14700 Optimize prefetching\n  - #14715 Optimize prefetch sizing logic\n  - #14636 Optimize ZRANK\n  - #14676 Utilize hardware clock by default on ARM AArch64\n  - #14575 Disable RDB compression when diskless replication is\n    used\n  - #14714 Optimize user ACL permission verification\n  - #14692 Optimize peak memory metric collection\n  - #14739 Avoid allocating and releasing list node in reply copy\n    avoidance\n  - #14713 Reduce per command syscalls by reusing cached time when\n    hardware monotonic clock is available\n  - #14726 Optimize XREADGROUP CLAIM\n  - #13962 Vector set: replace manual popcount with\n    __builtin_popcountll for binary vector distance (Intel, AMD,\n    ARM)\n  - #14474 Vector set: vectorized the quantized 8-bit vector\n    distance calculation (Intel, AMD)\n  - #14492 Vector set: vectorize binary quantization path for\n    vectorsets distance calculation (Intel, AMD) Configuration\n    parameters\n  - #14719 cluster-slot-stats-enabled - per-slot resource\n    consumptions statistics to collect\n  - #14695 key-memory-histograms collect memory consumption\n    histograms per data type Metrics\n  - #14695 db0_distrib_lists_sizes, db0_distrib_sets_sizes,\n    db0_distrib_hashes_sizes, db0_distrib_zsets_sizes\n  - #14610 acl_access_denied_tls_cert - failed TLS\n    certificate–based authentication attempts Modules API\n  - #14445\n    - RM_CreateKeyMetaClass - define a new key-metadata class\n    - RM_ReleaseKeyMetaClass - release a key-metadata class\n    - RM_SetKeyMeta - attach or update a metadata value for a key\n      under a specific metadata-key class\n    - RM_GetKeyMeta - get a metadata value for a key under a\n      specific metadata-key class Configuration parameters\n  - #14624 maxmemory-policy: new eviction policies: volatile-lrm,\n    allkeys-lrm\n  - #14615 stream-idmp-duration, stream-idmp-maxsize - defaults for\n    streams idempotent production\n  - #14610 tls-auth-clients-user TLS certificate-based automatic\n    client authentication\n  - #14596 flushdb option for repl-diskless-load: always flush the\n    entire dataset before diskless load Known bugs and limitations\n  - Streams: avoid using XADD with the new IDMP or IDMPAUTO options\n    when using appendonly yes with aof-use-rdb-preamble no (non\n    default). This limitation will be removed in the next patch.\n  - Redis Query Engine: In case of load rebalancing operations\n    (such as Atomic Slot Migration) taking place during the\n    lifetime of a cursor, there is a chance that some results may\n    be missing.\n\n- Updated to 8.4.1\n  * https://github.com/redis/redis/releases/tag/8.4.1\n  * Atomic slot migration: wrong adjacent slot range behavior.\n  * Atomic slot migration: support delay trimming slots after\n    finishing migrating slots.\n  * Fixed CLUSTER SLOT-STATS few memory tracking bugs.\n\n- Updated to 8.4.0\n  - Major changes compared to 8.2\n    - DIGEST, DELEX; SET extensions - atomic compare-and-set and\n      compare-and-delete for string keys\n    - MSETEX - atomically set multiple string keys and update their\n      expiration\n    - XREADGROUP - new CLAIM option for reading both idle pending\n      and incoming stream entries\n    - CLUSTER MIGRATION - atomic slot migration\n    - CLUSTER SLOT-STATS - per-slot usage metrics: key count, CPU\n      time, and network I/O\n    - Redis query engine: FT.HYBRID - hybrid search and fused\n      scoring\n    - Redis query engine: I/O threading with performance boost for\n      search and query commands (FT.*)\n    - I/O threading: substantial throughput increase (e.g. \u003e30% for\n      caching use cases (10% SET, 90% GET), 4 cores)\n    - JSON: substantial memory reduction for homogenous arrays (up\n      to 91%)\n","status":"published","published":"2026-08-20T14:41:12Z","modified":"2026-08-23T18:23:37.646040546Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1949-1","title":"Security update for valkey","description":"This update for valkey fixes the following issues\n\n- CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).\n- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution\n  (bsc#1264165).\n- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote\n  code execution (bsc#1264166).\n\nChanges for valkey:\n\n- Update to 8.0.9.\n","status":"published","published":"2026-05-18T07:51:15Z","modified":"2026-05-19T08:45:09.119628767Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1950-1","title":"Security update for valkey","description":"This update for valkey fixes the following issues\n\n- CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).\n- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution\n  (bsc#1264165).\n- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote\n  code execution (bsc#1264166).\n\nChanges for valkey:\n\n  - Update to 8.0.9:\n","status":"published","published":"2026-05-18T07:51:41Z","modified":"2026-05-19T08:45:09.17938639Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2097-1","title":"Security update for redis7","description":"This update for redis7 fixes the following issues\n\n- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution\n  (bsc#1264165).\n- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote\n  code execution (bsc#1264166).\n\nOther updates:\n\n- an user can manipulate data read by a connection by injecting sequences into a Redis error reply (bsc#1258706).\n","status":"published","published":"2026-05-27T14:20:47Z","modified":"2026-05-28T08:15:07.443605026Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2098-1","title":"Security update for redis","description":"This update for redis fixes the following issue\n\n- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote\n  code execution (bsc#1264166).\n","status":"published","published":"2026-05-27T14:21:31Z","modified":"2026-05-28T08:15:07.355178555Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2099-1","title":"Security update for redis","description":"This update for redis fixes the following issues\n\n- CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).\n- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution\n  (bsc#1264165).\n- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote\n  code execution (bsc#1264166).\n","status":"published","published":"2026-05-27T14:21:52Z","modified":"2026-05-28T08:15:07.306812446Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2100-1","title":"Security update for redis7","description":"This update for redis7 fixes the following issues\n\n- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution\n  (bsc#1264165).\n- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote\n  code execution (bsc#1264166).\n","status":"published","published":"2026-05-27T14:22:06Z","modified":"2026-05-28T08:15:07.406175335Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21814-1","title":"Security update for valkey","description":"This update for valkey fixes the following issues\n\n- CVE-2025-67733: data tampering and denial of service via improper null character handling in Lua scripts\n  (bsc#1258746).\n- CVE-2026-21863: denial of service via invalid clusterbus packet (bsc#1258788).\n- CVE-2026-23479: use-after-free in unblock client flow may lead to remote code execution (bsc#1264164).\n- CVE-2026-23631: Lua use-after-free via the master-replica synchronization mechanism may lead to remote code execution\n  (bsc#1264165).\n- CVE-2026-25243: invalid memory access in RESTORE command via a specially crafted serialized payload may lead to remote\n  code execution (bsc#1264166).\n\nChanges for valkey:\n\n  - Update to 8.0.9.\n\n  - Update to 8.0.7:\n\n   * Fix ltrim should not call signalModifiedKey when no elements are removed (#2787)\n   * Fix chained replica crash when doing dual channel replication (#2983)\n   * Fix used_memory_dataset underflow due to miscalculated used_memory_overhead (#3005)\n   * Avoids crash during MODULE UNLOAD when ACL rules reference a module command and\n     subcommand (#3160)\n   * Fix server assert on ACL LOAD and resetchannels (#3182)\n   * Fix bug causing no response flush sometimes when IO threads are busy (#3205)\n","status":"published","published":"2026-05-18T09:59:25Z","modified":"2026-05-28T18:24:12.658623862Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}