Redis 8.10.1

Remember When Redis Was Just a Cache?

Remember when Redis was a humble key-value store you pointed at a session table? Version 8.10.1, released August 17, 2026, is a quiet reminder of how far the database has come — and how much attack surface now travels with it.

From LRU Cache to Vector Database

What began in 2009 as a single-threaded in-memory cache now ships Vector Sets, HNSW graphs, and a module ecosystem. Every feature added along the way had to be audited again with fresh eyes — and this release found nine issues worth fixing in one go.

The Security Arc

Redis 8.10.1 is a security release, plain and simple. The headline is CVE-2026-62356, a heap out-of-bounds write lurking in CMSketch RDB loading. A miscalculated buffer size, a malicious payload, and memory corruption follows. In one path — an out-of-range SLOT_INFO slot id inside an RDB payload — that corruption escalates all the way to Remote Code Execution.

Vector Sets Pay for Their Youth

The Vector Sets work, which began its public arc only a few releases ago, accounts for three of these fixes alone: missing node level validation when loading a vector set from RDB, a use-after-free when VREM mutates the HNSW graph while background VSIM threads are running, and a negative hnsw_search() return that was misread as a huge unsigned count — walking reads past the end of result arrays.

Identity and TLS, Hardened

Authentication earns its own chapter in this release's history. A Common Name containing an embedded NUL byte was truncated during client-certificate verification, letting one client authenticate as another — potentially privileged — ACL user. That door is shut now, alongside a use-after-free in the TLS pending-data list triggered when a command closes another pending connection.

The Fix List in Full

• CVE-2026-62356 — heap out-of-bounds write in CMSketch RDB loading
• Out-of-bounds access in the TopK heap cleanup path (MOD-15410)
• Use-after-free in the TLS pending-data list when a command closes another pending connection
• RDB memory corruption via out-of-range SLOT_INFO slot id — may lead to Remote Code Execution
• Vector Sets: missing node level validation when loading a vector set from RDB
• Vector Sets: use-after-free when VREM mutates the HNSW graph while VSIM threads run
• Vector Sets: negative hnsw_search() return read as unsigned, reading past result arrays
• TLS client certificate authentication bypass via embedded NUL byte in Common Name
• Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key (#15594)

Where It Leaves Us

Nothing breaks in 8.10.1 — no new features, no deprecations, just history being corrected. If you load untrusted RDB files, run TLS client certificate auth, or lean on Vector Sets, this is the release to take seriously. The trajectory from cache to platform continues; so does the work of keeping it secure.