RS: security updates - #3825
Merged
Merged
Conversation
Contributor
🧠 Redis MemoryFound 15 related items from repository history (2 new this commit):
Memory updated at 5d51916 |
Contributor
dwdougherty
approved these changes
Aug 17, 2026
Merged
Yaacov confirmed the version bounds: the vector set fixes apply from Redis 8.2, and tls-auth-clients-user CN from Redis 8.6. Listing them under older Redis versions claimed a fix for a feature those versions do not have. Vector set entries now appear under 8.6/8.4/8.2 only, and the certificate common-name entry under 8.6 only. The four core Nexus entries, the stream consumer group entry, and both Melissa entries are unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the Melissa and Nexus security entries to the RS release notes (DOC-6970).
Sources: GHSA-q5p6-hwxh-c23h
for CVE-2026-62356; cherry-pick tickets RED-210241/210242/210243 for the build mapping.
Vector set entries are scoped to Redis 8.2+ and the TLS CN entry to 8.6+, per Yaacov.
Supersedes #3801.
Note
Low Risk
Documentation-only edits to release-note markdown; accuracy of version-to-fix mapping should be confirmed in review, especially Nexus entries under older Redis line sections.
Overview
Updates Redis Software release notes so the Open source Redis security fixes compatibility lists reflect recent Melissa and Nexus backports (DOC-6970).
RedisBloom (all touched builds): Prepends CVE-2026-62356 (crafted
CMSketchviaRESTORE/RDB) and a TopK heap-cleanup out-of-bounds item at the top of each applicable Redis OSS version subsection (7.2.x, 6.2.x, and 7.4.x/8.x where those lines ship), following the existing “propagate to every release at or after the fix” pattern across RS 7.2.4, 7.4.6, 7.8.6, 7.22.2, 8.0.20, and 8.2.0 note pages.Nexus batch (newer cherry-pick builds only):
rs-8-0-20-96.mdandrs-8-2-0-46.mdalso gain a block of additional fixes at the head of each Redis version section—e.g.SLOT_INFOmemory corruption, TLS pending-data UAF, stream consumer-groupRESTORE/RDB UAF,GEORADIUSACL bypass, command key-extraction OOB read, VSET RDB validation gaps, and (on 8.6.x)tls-auth-clients-userCN auth bypass—plus the same RedisBloom lines. Other pages in the diff only receive the two RedisBloom bullets.No product code changes; reviewers should sanity-check which OSS version sections include VSET/TLS entries versus 8.x-only, as flagged in the PR description.
Reviewed by Cursor Bugbot for commit 5d51916. Bugbot is set up for automated code reviews on this repo. Configure here.