OPENSUSE-SU-2026:21612-1: redis-modules&distro=openSUSE Leap 16.0 openSUSE

Vulnerability summary

OPENSUSE-SU-2026:21612-1 is a vulnerability in redis-modules&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Timeline

1. 20-08-2026
   PublishedVulnerability first disclosed.
2. 23-08-2026
   Last modifiedVulnerability information updated.

Description

Security update for redis This update for redis fixes the following issues: Changes in redis: - Update to 8.10.1 Update urgency: SECURITY: There are security fixes in the release. - Security fixes - (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write - Out-of-bounds access in TopK heap cleanup path (MOD-15410) - Use-after-free in the TLS pending-data list when a command closes another pending connection - A malicious RDB payload with an out-of-range SLOT_INFO slot id causes memory corruption during RDB loading, which may lead to Remote Code Execution - Vector Sets: missing node level validation when loading a vector set from RDB may lead to out-of-bounds access - Vector Sets: use-after-free when VREM mutates the HNSW graph while background VSIM threads are still running - Vector Sets: a negative hnsw_search() return was treated as a huge unsigned count, reading past the end of the result arrays - TLS client certificate authentication bypass: a Common Name containing an embedded NUL byte was truncated, allowing a client to authenticate as another (possibly privileged) ACL user - #15594 Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key - Restrict the "modules" flavour to x86_64 and aarch64 -- RedisBloom and RedisTimeSeries abort on anything else with "only supports 64-bit architectures (x64, arm64v8)", redisjson's vendored redis-module is 64-bit only, and modules/common.mk maps no other architecture at all - Update to 8.10.0 Major changes compared to 8.8 - Compact hashes - a new hash encoding that reduces memory usage by storing hash field names just once for keys that share a schema - New command: HIMPORT - high-throughput compact hash bulk insertion - TLS peer certificate-based server-to-server authentication - New commands: LMOVEM, BLMOVEM - move multiple elements between lists - New command: SUNIONCARD - get the cardinality of the union of multiple sets - New command: SDIFFCARD - get the cardinality of the difference between sets - New command: BACKUP - node-side implementation for backup and restore based on multi-part AOF (MP-AOF) - XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size - New command: FT.ALIASLIST - get all aliases for the index - Stemmer support for Malay and Tagalog languages - JSONPath extensions - New commands: TS.NRANGE, TS.NREVRANGE - Query a range across multiple time series; group results by timestamp - New command: TS.READ - optionally blocking read - New command: TS.QUERYLABELS - Get a list of labels and label-values - New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY argument to exclude series with no reported samples - Performance improvements - Update to 8.8.1 Security fixes - RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution - Update to 8.8.0 - New data structure: Array (@antirez) - Subkey notification for hash fields - field-level notifications - INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team) - XNACK: a new streams command - allow consumers to explicitly release pending messages - ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator - JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays - TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple aggregators in a single command - FT.HYBRID KNN clause: new argument to request fewer candidates per shard - FT.PROFILE HYBRID: profiling support for FT.HYBRID - Performance improvements - Updated to 8.6.3 (boo#1264164 boo#1264165 boo#1264166 boo#1264167 boo#1264168) - Security fixes - (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution. - (CVE-2026-25243) Invalid memory access in RESTORE may lead to Remote Code Execution - (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution - (CVE-2026-25588) Invalid memory access in RESTORE may lead to Remote Code Execution (Time Series) - (CVE-2026-25589) Invalid memory access in RESTORE may lead to Remote Code Execution (Probabilistic) - Bug fixes - SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788) - CONFIG SET: some settings allow invalid characters (RED-167787) - SCRIPT DEBUG: potential crash on scripts (RED-175507) - VADD: crash or buffer overflow on large REDUCE value (RED-170921) - VSET: crash on huge allocations (MOD-12678) - Potential crash on disconnections and TLS failures (Time Series) (MOD-14850) - RediSearch/RediSearch#8745 Crash when many keys receive expirations under heavy TTL activity (MOD-14500) - RediSearch/RediSearch#8848 HNSW vector index memory growth under high-churn workloads until shard restart (MOD-13761) - RediSearch/RediSearch#8205, RediSearch/RediSearch#8259 FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero results (MOD-12370, MOD-13884) - RediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty reply (MOD-14778) - RediSearch/RediSearch#8129, RediSearch/RediSearch#8140 FT.PROFILE reports an incorrect shard total profile time (MOD-13735, MOD-13181) - RediSearch/RediSearch#9047 FT.PROFILE output is inconsistent when a profiled value is missing (MOD-10560) - RediSearch/RediSearch#8791 FT.EXPLAIN does not lock, causing a race with concurrent index changes (MOD-14461) - RediSearch/RediSearch#8382 Crash when indexing negative zero (-0.0) (MOD-13904) - RediSearch/RediSearch#8590 FILTER returns inconsistent results with multiple indexes sharing field aliases (MOD-14063) - RediSearch/RediSearch#8660 FILTER behavior depends on property order in the expression (MOD-14065) - RediSearch/RediSearch#8593 Filter expressions are evaluated for indexes that do not match the document type (MOD-14064) - RediSearch/RediSearch#8591 Documents are inconsistently included or excluded depending on the indexing path taken (MOD-13948) - RediSearch/RediSearch#8589 RENAME notification handler loads the wrong key, causing stale index entries after a rename (MOD-14328) - RediSearch/RediSearch#9012 PERSIST and HPERSIST notifications are not reflected in index expiration tracking (MOD-14800) - RediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS placeholders as literal terms instead of resolving them (MOD-10596) - RediSearch/RediSearch#8462 GC out-of-memory on replica shards leaves the replica in an inconsistent state (MOD-14066) - RediSearch/RediSearch#9066 Race condition in FT.HYBRID causes intermittent failures under concurrent hybrid query load (MOD-14732) - RediSearch/RediSearch#8109, RediSearch/RediSearch#8149 Configuration registration omits module parameters, causing them to be unexposed or misapplied (RED-171841) - RediSearch/RediSearch#9163 Crash on FT.SEARCH when topology validation fails (for example, some nodes unreachable) (MOD-14475) - RediSearch/RediSearch#8395 FT.SEARCH fails with "Query requires unavailable slots" after shard restart or failover (MOD-13828) - RediSearch/RediSearch#8451 FT.INFO-style output no longer reports zero-index summary data when no indices exist (MOD-14079) - RediSearch/RediSearch#9078 FT.CREATE now rejects schema definitions with invalid option combinations at creation time (MOD-14655) - RediSearch/RediSearch#8051, RediSearch/RediSearch#8114 Crash diagnostics now include the IndexSpec of the index the failing thread was working on (MOD-7574) - Metrics - RediSearch/RediSearch#8210, RediSearch/RediSearch#8231 FT.PROFILE: added queue time tracking (MOD-13602) - Updated to 8.6.2 (boo#1260399) * Fixed potential UAF: don't use reply copy avoidance for module strings. * Fixed crash during command processing on replicas performing. full synchronization. * Fixed potential Memory leaks. * Fixed potential crash during ACL checks on wrong-arity commands. * Fixed HSETEX HGETEX do not validate that FIELDS is specified only once. - Updated to 8.6.1 (boo#1258706) * Fixed user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply. * Fixed INFO command may display module information, and the missing HOTKEYS HELP subcommand has been added. * Fixed RDB loading prevented hash table expansion. - Updated to 8.6.0 Major changes compared to 8.4 - Substantial performance improvements - Substantial memory reduction for hashes (hashtable-encoded) and sorted sets (skiplist-encoded) - Streams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments - New eviction policies - least recently modified: volatile-lrm and allkeys-lrm - Hot keys detection and reporting; new command: HOTKEYS - TLS certificate-based automatic client authentication - Time series: support NaN values; new aggregators: COUNTNAN and COUNTALL New Features - #14695 Keys memory size histograms - #14615 Streams: XADD idempotency (at-most-once guarantee) with new IDMPAUTO and IDMP arguments - #14624 New eviction policies - least recently modified: volatile-lrm and allkeys-lrm - #14680 Hot keys detection and reporting; new command: HOTKEYS - #14610 TLS certificate-based automatic client authentication - RedisTimeSeries/RedisTimeSeries#1853 Time series: support NaN values; new aggregators: COUNTNAN and COUNTALL Security and privacy fixes - #14645 Hide Personally Identifiable Information from ACL log - #14659 ACL: Key-pattern bypass in MSETEX - RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474 Hide Personally Identifiable Information from server log - RedisBloom/RedisBloom#950 Out-of-bounds read when loading an invalid RDB file (MOD-12802) Bugfixes - #14545 ACL: AOF loading fails if ACL rules are changed and don't allow some commands in MULTI-EXEC - #14637 Atomic slot migration: wrong adjacent slot range behavior - #14567 Atomic slot migration: support delay trimming slots after finishing migrating slots - #14623 Streams: XTRIM/XADD with approx mode (~) don’t delete entries for DELREF/ACKED strategies - #14552 Streams: Incorrect behavior when using XDELEX...ACKEDafterXGROUP DESTROY` - #14537 SCAN: restore original filter order (revert change introduced in 8.2) - #14581 Rare server hang at shutdown - #14597 Panic when cluster node is uninitialized - #14583 FLUSHALL ASYNC on a writable replica may block the main thread for an extended period - #14504 Cluster: fix race condition in broadcast configuration - #14416 Fixed argument position handling in Redis APIs - RedisTimeSeries/RedisTimeSeries#1784, RedisTimeSeries/RedisTimeSeries#1839, RedisBloom/RedisBloom#952, RedisJSON/RedisJSON#1477 Atomic slot migration support - RedisBloom/RedisBloom#946 MEMORY USAGE: fix reported value (MOD-12799) - RedisJSON/RedisJSON#1473 Adding escapes to already-escaped characters (MOD-8137) - RedisJSON/RedisJSON#1475 JSON.CLEAR does not error if more than one path is specified (MOD-13109) Performance and resource utilization improvements - #14608 Reply copy-avoidance path to reduce memory copies for bulk string replies - #14595 Hash: unify field name and value into a single struct - #14701 Sorted set: unify score and value into a single struct - #14662 Optimize listpack iterator on hash fields - #14699 Optimize set commands with expiration - #14700 Optimize prefetching - #14715 Optimize prefetch sizing logic - #14636 Optimize ZRANK - #14676 Utilize hardware clock by default on ARM AArch64 - #14575 Disable RDB compression when diskless replication is used - #14714 Optimize user ACL permission verification - #14692 Optimize peak memory metric collection - #14739 Avoid allocating and releasing list node in reply copy avoidance - #14713 Reduce per command syscalls by reusing cached time when hardware monotonic clock is available - #14726 Optimize XREADGROUP CLAIM - #13962 Vector set: replace manual popcount with __builtin_popcountll for binary vector distance (Intel, AMD, ARM) - #14474 Vector set: vectorized the quantized 8-bit vector distance calculation (Intel, AMD) - #14492 Vector set: vectorize binary quantization path for vectorsets distance calculation (Intel, AMD) Configuration parameters - #14719 cluster-slot-stats-enabled - per-slot resource consumptions statistics to collect - #14695 key-memory-histograms collect memory consumption histograms per data type Metrics - #14695 db0_distrib_lists_sizes, db0_distrib_sets_sizes, db0_distrib_hashes_sizes, db0_distrib_zsets_sizes - #14610 acl_access_denied_tls_cert - failed TLS certificate–based authentication attempts Modules API - #14445 - RM_CreateKeyMetaClass - define a new key-metadata class - RM_ReleaseKeyMetaClass - release a key-metadata class - RM_SetKeyMeta - attach or update a metadata value for a key under a specific metadata-key class - RM_GetKeyMeta - get a metadata value for a key under a specific metadata-key class Configuration parameters - #14624 maxmemory-policy: new eviction policies: volatile-lrm, allkeys-lrm - #14615 stream-idmp-duration, stream-idmp-maxsize - defaults for streams idempotent production - #14610 tls-auth-clients-user TLS certificate-based automatic client authentication - #14596 flushdb option for repl-diskless-load: always flush the entire dataset before diskless load Known bugs and limitations - Streams: avoid using XADD with the new IDMP or IDMPAUTO options when using appendonly yes with aof-use-rdb-preamble no (non default). This limitation will be removed in the next patch. - Redis Query Engine: In case of load rebalancing operations (such as Atomic Slot Migration) taking place during the lifetime of a cursor, there is a chance that some results may be missing. - Updated to 8.4.1 * https://github.com/redis/redis/releases/tag/8.4.1 * Atomic slot migration: wrong adjacent slot range behavior. * Atomic slot migration: support delay trimming slots after finishing migrating slots. * Fixed CLUSTER SLOT-STATS few memory tracking bugs. - Updated to 8.4.0 - Major changes compared to 8.2 - DIGEST, DELEX; SET extensions - atomic compare-and-set and compare-and-delete for string keys - MSETEX - atomically set multiple string keys and update their expiration - XREADGROUP - new CLAIM option for reading both idle pending and incoming stream entries - CLUSTER MIGRATION - atomic slot migration - CLUSTER SLOT-STATS - per-slot usage metrics: key count, CPU time, and network I/O - Redis query engine: FT.HYBRID - hybrid search and fused scoring - Redis query engine: I/O threading with performance boost for search and query commands (FT.*) - I/O threading: substantial throughput increase (e.g. >30% for caching use cases (10% SET, 90% GET), 4 cores) - JSON: substantial memory reduction for homogenous arrays (up to 91%)

No weakness data has been published for this record.