Back to Changelog
Redis
v8.6.6
Security update fixing critical remote code execution and ACL bypass vulnerabilities.
Security Fixes
6- Fixed use-after-free in RESTORE command with crafted stream data that could lead to remote code execution.
- Fixed out-of-bounds write in RedisBloom/TDigest RESTORE that could lead to remote code execution.
- Fixed heap out-of-bounds read in CMSketch RDB loading (CVE-2026-62356).
- Fixed use-after-free in TLS connection handling.
- Fixed ACL key permission bypass in SORT, GEORADIUS and XREAD commands.
- Fixed memory corruption from malicious RDB SLOT_INFO data that could lead to remote code execution.