Release notes from redis

8.12-m02-int: Explain a test [TIMEOUT] instead of killing it silently (#15879)

2026-09-28T07:34:42Z

A hung test run tells us almost nothing today. When no client has made
progress for --timeout seconds, test_server_cron prints the clients'
last reported state, SIGKILLs every server via force_kill_all_servers
and exits; --dump-logs only fires for a failed or excepted test, never
for a timeout. So a 20-minute hang costs a whole CI run and produces a
few lines.

Collect the evidence before tearing the run down:

Crash-report the surviving servers. SIGSEGV makes redis log a stack
trace of every one of its threads plus INFO, the client list and the
config (printCrashReport) and then die. The handler runs on whichever
thread takes the signal, so it works on a server whose event loop is
wedged -- exactly the case we cannot diagnose from outside. kill_server
already resorts to SIGSEGV for the same reason when a server won't exit,
but the timeout path never reaches it. Then print each server's crash
report, starting 10 lines above "REDIS BUG REPORT START" for context (or
the log's tail if there is no report, since that is then the only
evidence). Servers are children of the stuck client, which isn't reaping
them, so a dead one is a zombie that kill -0 still reports alive; wait
on is_running (via ps) instead.

Report where in the test each client stopped, not just its last state.
Crash-reporting the servers usually unblocks a client by itself -- its
connection dies, the error unwinds, and the client's existing top-level
handler reports $::errorInfo, a Tcl stack trace naming the exact line --
so collect that first. A client stuck on something else is poked with
SIGUSR1, which it turns into a Tcl error with Tclx's "signal error":
that interrupts a blocking read, a long "after" and a polling loop
alike. Tclx is optional; without it a timeout simply reports no client
stack trace.

Order matters here: the servers must be collected first, because
unblocking a client makes start_server kill the very servers we wanted a
report from.

Also: read_from_test_client threw "expected non-negative integer" once a
reporting client exited, because we now pump the event loop while it
does.

Note

Low Risk
Changes are limited to the Tcl test harness timeout path; no
production server or runtime behavior is affected.

Overview
When the suite hits --timeout (no client progress), it no longer
tears down immediately after printing each client’s last task. The test
server collects diagnostics first, then kills clients and servers as
before.

Server evidence: Still-running Redis instances from
::active_servers get SIGCONT (if stopped) and SIGSEGV so they
write a full crash report even when the event loop is wedged. Logs are
located under tests/tmp by pid, then dump_crash_report prints
the tail around REDIS BUG REPORT START (or the last 256KB if there is
no report). is_running treats zombies as dead so waits don’t hang
on unreaped children.

Client evidence: Clients send their OS pid on ready and
optionally advertise sigusr1-trace when Tclx is available. After
server dumps, the server waits briefly for natural exception/err
unwinds, then sends SIGUSR1 to remaining clients so Tclx turns it
into a stack trace. ::in_timeout_report suppresses re-entrant
timeout cron, avoids fatal handling of those packets, and fixes
read_from_test_client when a client disconnects mid-report
(invalid length no longer spins or crashes the handler).

Order: Server crash collection runs before client stack traces
so unblocking a client doesn’t tear down servers before their reports
are captured.

^{Reviewed by Cursor Bugbot for commit

5927e7e. Bugbot is set up for automated

code reviews on this repo. Configure

here.}

Co-authored-by: Claude Opus 5.5 (1M context) noreply@anthropic.com

8.10.2

2026-09-17T15:08:27Z

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus
TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
RedisSearch: KNN queries on indexes with very long vector field names could cause the server to crash
Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

8.8.3

2026-09-17T15:04:35Z

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus
TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

8.6.7

2026-09-17T15:01:42Z

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus
TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

8.4.7

2026-09-17T14:58:05Z

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

#15673 Commands queued in a transaction could still access keys whose ACL permissions were revoked before the transaction was executed
#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus
TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

8.2.10

2026-09-17T14:53:52Z

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

#15722 The cluster bus protocol has no authentication of its own unless tls-cluster is enabled, so any host able to reach a node's bus port could join the cluster and threaten it. A cluster node now warns at startup when its bus port is left unauthenticated, and the new cluster-bus-port-protected-mode option (default no) makes refusing to run in that state an explicit choice: set it to yes and the node starts only when tls-cluster authenticates the bus
TimeSeries: Prevented Redis from crashing when adding samples to a compressed Time Series key restored from a malformed RDB payload
Vector Sets: Deeply nested JSON used in Vector Set queries could cause the server to crash

8.12-m01-int: Add aof_cmd_duration estimate for AOF reload RTO visibility

2026-09-15T07:51:32Z

Expose a best-effort AOF replay-time estimate in INFO persistence so
operators can gauge reload RTO. Count time only for writes that enter
the AOF, credit leftover call() time to synthetic rewrites, and skip
the bookkeeping when AOF is off.

8.10.1

2026-08-17T16:46:02Z

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
Out-of-bounds access in TopK heap cleanup path (MOD-15410)
Use-after-free in the TLS pending-data list when a command closes another pending connection
A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

8.8.2

2026-08-17T16:41:01Z

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
Out-of-bounds access in TopK heap cleanup path (MOD-15410)
Use-after-free in the TLS pending-data list when a command closes another pending connection
#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key

8.6.6

2026-08-17T16:39:37Z

Update urgency: SECURITY: There are security fixes in the release.

Security fixes

(CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write
Out-of-bounds access in TopK heap cleanup path (MOD-15410)
Use-after-free in the TLS pending-data list when a command closes another pending connection
#15478 ACL key permission bypass in SORT, GEORADIUS/GEORADIUSBYMEMBER and XREAD/XREADGROUP: the keys validated by ACL could differ from the keys the command actually accesses
A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution
Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access
Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running
Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays
TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user
#15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key