{ "schema_version": 2, "id": "operate/oss_and_stack/stack-with-enterprise/release-notes/redisce/redisce-7.4-release-notes", "title": "Redis Community Edition 7.4 release notes", "url": "https://redis.io/docs/latest/operate/oss_and_stack/stack-with-enterprise/release-notes/redisce/redisce-7.4-release-notes/", "summary": "Redis Community Edition 7.4 release notes.", "tags": [ "docs", "operate", "stack" ], "last_updated": "2026-08-17T13:21:31-07:00", "page_type": "content", "content_hash": "4f545b61c9bad0f1dc499ab691d7113fea9a6444a093f633d236b8c4a7062dad", "sections": [ { "id": "redis-community-edition-7411-august-2026", "title": "Redis Community Edition 7.4.11 (August 2026)", "role": "overview", "text": "Update urgency: `SECURITY`: There are security fixes in the release." }, { "id": "security-fixes", "title": "Security fixes", "role": "security", "text": "- Use-after-free in the TLS pending-data list when a command closes another pending connection.\n- [#15478](https://github.com/redis/redis/pull/15478) ACL key permission bypass in `SORT`, `GEORADIUS`/`GEORADIUSBYMEMBER` and `XREAD`/`XREADGROUP`: the keys validated by ACL could differ from the keys the command actually accesses.\n- [#14847](https://github.com/redis/redis/pull/14847) Out-of-bounds `argv` access during key extraction when checking ACL permissions of a `KEYNUM` keyspec command (for example, `EVAL`) with wrong arity.\n- A malicious RDB payload with an out-of-range `SLOT_INFO slot id` causes memory corruption during RDB loading, which may lead to Remote Code Execution.\n- [#15594](https://github.com/redis/redis/pull/15594) Use-after-free in the blocked-client list when reprocessing a command evicts another client blocked on the same key." }, { "id": "redis-community-edition-7410-july-2026", "title": "Redis Community Edition 7.4.10 (July 2026)", "role": "content", "text": "Update urgency: `SECURITY`: There is a security fix in the release." }, { "id": "security-fixes-1", "title": "Security fixes", "role": "security", "text": "- A crafted stream `RESTORE` payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution." }, { "id": "redis-community-edition-749-may-2026", "title": "Redis Community Edition 7.4.9 (May 2026):", "role": "content", "text": "Update urgency: `SECURITY`: There are security fixes in the release." }, { "id": "security-fixes-2", "title": "Security fixes", "role": "security", "text": "- (CVE-2026-23479) Use-After-Free in unblock client flow may lead to Remote Code Execution.\n- (CVE-2026-25243) Invalid memory access in `RESTORE` may lead to Remote Code Execution.\n- (CVE-2026-23631) Lua Use-After-Free may lead to remote code execution." }, { "id": "bug-fixes", "title": "Bug fixes", "role": "content", "text": "- `SUBSCRIBE`, `PSUBSCRIBE`, `SSUBSCRIBE`: crash on OOM (RED-167788).\n- `CONFIG SET`: some settings allow invalid characters (RED-167787).\n- `SCRIPT DEBUG`: potential crash on scripts (RED-175507)." }, { "id": "redis-community-edition-748-february-2026", "title": "Redis Community Edition 7.4.8 (February 2026)", "role": "content", "text": "Update urgency: `SECURITY`: There are security fixes in the release." }, { "id": "security-fixes-3", "title": "Security fixes", "role": "security", "text": "- A user can manipulate data read by a connection by injecting `\\r\\n` sequences into a Redis error reply." }, { "id": "redis-community-edition-747-november-2025", "title": "Redis Community Edition 7.4.7 (November 2025)", "role": "content", "text": "Update urgency: `HIGH`: There is a critical bug that may affect a subset of users." }, { "id": "bug-fixes-1", "title": "Bug fixes", "role": "content", "text": "- Potential crash on HyperLogLog with 2GB+ entries" }, { "id": "redis-community-edition-746-october-2025", "title": "Redis Community Edition 7.4.6 (October 2025)", "role": "content", "text": "Update urgency: `SECURITY`: There are security fixes in the release." }, { "id": "security-fixes-4", "title": "Security fixes", "role": "security", "text": "- (CVE-2025-49844) A Lua script may lead to remote code execution\n- (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE\n- (CVE-2025-46818) A Lua script can be executed in the context of another user\n- (CVE-2025-46819) LUA out-of-bound read" }, { "id": "bug-fixes-2", "title": "Bug fixes", "role": "content", "text": "- [#14330](https://github.com/redis/redis/pull/14330) Potential use-after-free after pubsub and Lua defrag\n- [#14319](https://github.com/redis/redis/pull/14319) Potential crash on Lua script defrag\n- [#14164](https://github.com/redis/redis/pull/14164) Prevent `CLIENT UNBLOCK` from unblocking `CLIENT PAUSE`\n- [#14165](https://github.com/redis/redis/pull/14165) Endless client blocking for blocking commands\n- [#14163](https://github.com/redis/redis/pull/14163) `EVAL` crash when error table is empty\n- [#14227](https://github.com/redis/redis/pull/14227) `HINCRBYFLOAT` removes field expiration on replica" }, { "id": "redis-community-edition-745-july-2025", "title": "Redis Community Edition 7.4.5 (July 2025)", "role": "content", "text": "Update urgency: `SECURITY`: There are security fixes in the release." }, { "id": "security-fixes-5", "title": "Security fixes", "role": "security", "text": "* (CVE-2025-27151) redis-check-aof may lead to stack overflow and potential RCE" }, { "id": "bug-fixes-3", "title": "Bug fixes", "role": "content", "text": "- [#13966](https://github.com/redis/redis/pull/13966), [#13932](https://github.com/redis/redis/pull/13932) `CLUSTER SLOTS` - TLS port update not reflected in CLUSTER SLOTS\n- [#13958](https://github.com/redis/redis/pull/13958) `XTRIM`, `XADD` - incorrect lag due to trimming stream" }, { "id": "redis-community-edition-744-may-2025", "title": "Redis Community Edition 7.4.4 (May 2025):", "role": "content", "text": "Update urgency: `SECURITY`: There are security fixes in the release." }, { "id": "security-fixes-6", "title": "Security fixes", "role": "security", "text": "* (CVE-2025-27151) redis-check-aof may lead to stack overflow and potential RCE." }, { "id": "bug-fixes-4", "title": "Bug fixes", "role": "content", "text": "- [#13966](https://github.com/redis/redis/pull/13966), [#13932](https://github.com/redis/redis/pull/13932) `CLUSTER SLOTS` - TLS port update not reflected in CLUSTER SLOTS.\n- [#13958](https://github.com/redis/redis/pull/13958) `XTRIM`, `XADD` - incorrect lag due to trimming stream." }, { "id": "redis-community-edition-743-april-2025", "title": "Redis Community Edition 7.4.3 (April 2025)", "role": "content", "text": "Update urgency: `SECURITY`: There are security fixes in the release." }, { "id": "security-fixes-7", "title": "Security fixes", "role": "security", "text": "* (CVE-2025-21605) An unauthenticated client can cause an unlimited growth of output buffers." }, { "id": "bug-fixes-5", "title": "Bug fixes", "role": "content", "text": "* [#13661](https://github.com/redis/redis/pull/13661) `FUNCTION FLUSH` - memory leak when using jemalloc.\n* [#13793](https://github.com/redis/redis/pull/13793) `WAITAOF` returns prematurely.\n* [#13853](https://github.com/redis/redis/pull/13853) `SLAVEOF` - crash when clients are blocked on lazy free.\n* [#13863](https://github.com/redis/redis/pull/13863) `RANDOMKEY` - infinite loop during client pause.\n* [#13877](https://github.com/redis/redis/pull/13877) ShardID inconsistency when both primary and replica support it." }, { "id": "redis-community-edition-742-jan-2025", "title": "Redis Community Edition 7.4.2 (Jan 2025)", "role": "content", "text": "Upgrade urgency SECURITY: See security fixes below." }, { "id": "security-fixes-8", "title": "Security fixes", "role": "security", "text": "- (CVE-2024-46981) Lua script commands may lead to remote code execution\n- (CVE-2024-51741) Denial-of-service due to malformed ACL selectors" }, { "id": "bug-fixes-6", "title": "Bug fixes", "role": "content", "text": "- [#13627](https://github.com/redis/redis/pull/13627) Crash on module memory defragmentation\n- [#13338](https://github.com/redis/redis/pull/13338) Streams: `XINFO` lag field is wrong when tombstone is after the `last_id` of the consume group\n- [#13473](https://github.com/redis/redis/pull/13473) Streams: `XTRIM` does not update the maximal tombstone, leading to an incorrect lag\n- [#13470](https://github.com/redis/redis/pull/13470) `INFO` after `HDEL` show wrong number of hash keys with expiration\n- [#13476](https://github.com/redis/redis/pull/13476) Fix a race condition in the `cache_memory` of `functionsLibCtx`\n- [#13626](https://github.com/redis/redis/pull/13626) Memory leak on failed RDB loading\n- [#13539](https://github.com/redis/redis/pull/13539) Hash: fix key ref for a hash that no longer has fields with expiration on `RENAME`/`MOVE`/`SWAPDB`/`RESTORE`\n- [#13443](https://github.com/redis/redis/pull/13443) Cluster: crash when loading cluster config\n- [#13422](https://github.com/redis/redis/pull/13422) Cluster: `CLUSTER SHARDS` returns empty array\n- [#13465](https://github.com/redis/redis/pull/13465) Cluster: incompatibility with older node versions\n- [#13608](https://github.com/redis/redis/pull/13608) Cluster: `SORT ... GET #`: incorrect error message" }, { "id": "redis-community-edition-741-october-2024", "title": "Redis Community Edition 7.4.1 (October 2024)", "role": "content", "text": "Upgrade urgency SECURITY: See security fixes below." }, { "id": "security-fixes-9", "title": "Security fixes", "role": "security", "text": "* (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE.\n* (CVE-2024-31227) Potential Denial-of-service due to malformed ACL selectors.\n* (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching.\n\nFor more information, see the [Redis blog post](https://redis.io/blog/security-advisory-cve-2024-31449-cve-2024-31227-cve-2024-31228/) about these vulnerabilities." }, { "id": "redis-community-edition-74-july-2024", "title": "Redis Community Edition 7.4 (July 2024)", "role": "content", "text": "This is the General Availability release of Redis Community Edition 7.4.\n\n**Changes to new 7.4 features (compared to 7.4 RC2)**\n* [#13391](https://github.com/redis/redis/pull/13391),[#13438](https://github.com/redis/redis/pull/13438) Hash - expiration of individual fields: RDB file format changes\n* [#13372](https://github.com/redis/redis/pull/13372) Hash - expiration of individual fields: rename and fix counting of `expired_subkeys` metric\n* [#13372](https://github.com/redis/redis/pull/13372) Hash - expiration of individual fields: rename `INFO` keyspace field to `subexpiry`\n\n**Configuration parameters**\n* [#13400](https://github.com/redis/redis/pull/13400) Add hide-user-data-from-log - allows hiding user data from the log file\n\n**Bug fixes**\n* [#13407](https://github.com/redis/redis/pull/13407) Trigger Lua GC after `SCRIPT LOAD`\n* [#13380](https://github.com/redis/redis/pull/13380) Fix possible crash due to OOM panic on invalid command\n* [#13383](https://github.com/redis/redis/pull/13383) `FUNCTION FLUSH` - improve Lua GC behavior and fix thread race in ASYNC mode\n* [#13408](https://github.com/redis/redis/pull/13408) `HEXPIRE`-like commands should emit `HDEL` keyspace notification if expire time is in the past" }, { "id": "redis-community-edition-74-rc2-june-2024", "title": "Redis Community Edition 7.4-rc2 (June 2024)", "role": "content", "text": "Upgrade urgency LOW: This is the second Release Candidate for Redis Community Edition 7.4.\n\n**Performance and resource utilization improvements**\n* [#13296](https://github.com/redis/redis/pull/13296) Optimize CPU cache efficiency\n\n**Changes to new 7.4 new features (compared to 7.4 RC1)**\n* [#13343](https://github.com/redis/redis/pull/13343) Hash - expiration of individual fields: when key does not exist - reply with an array (nonexisting code for each field)\n* [#13329](https://github.com/redis/redis/pull/13329) Hash - expiration of individual fields: new keyspace event: `hexpired`\n\n**Modules API - Potentially breaking changes to new 7.4 features (compared to 7.4 RC1)**\n* [#13326](https://github.com/redis/redis/pull/13326) Hash - expiration of individual fields: avoid lazy expire when called from a Modules API function" }, { "id": "redis-community-edition-74-rc1-june-2024", "title": "Redis Community Edition 7.4-rc1 (June 2024)", "role": "content", "text": "Upgrade urgency LOW: This is the first Release Candidate for Redis Community Edition 7.4.\n\nHere is a comprehensive list of changes in this release compared to 7.2.5.\n\n**New Features**\n* [#13303](https://github.com/redis/redis/pull/13303) Hash - expiration of individual fields. 9 commands were introduced:\n - `HEXPIRE` and `HPEXPIRE` set the remaining time to live for specific fields\n - `HEXPIREAT` and `HPEXPIREAT` set the expiration time to a UNIX timestamp for specific fields\n - `HPERSIST` removes the expiration for specific fields\n - `HEXPIRETIME` and `HPEXPIRETIME` get the expiration time for specific fields\n - `HTTL` and `HPTTL` get the remaining time to live for specific fields\n* [#13117](https://github.com/redis/redis/pull/13117) `XREAD`: new id value `+` to start reading from the last message\n* [#12765](https://github.com/redis/redis/pull/12765) `HSCAN`: new `NOVALUES` flag to report only field names\n* [#12728](https://github.com/redis/redis/pull/12728) `SORT`, `SORT_RO`: allow `BY` and `GET` options in cluster mode when the pattern maps to the same slot as the key\n* [#12299](https://github.com/redis/redis/pull/12299) `CLIENT KILL`: new optional filter: `MAXAGE maxage` - kill connections older than `maxage` seconds\n* [#12971](https://github.com/redis/redis/pull/12971) Lua: expose `os.clock()` API for getting the elapsed time of Lua code execution\n* [#13276](https://github.com/redis/redis/pull/13276) Allow `SPUBLISH` command within `MULTI ... EXEC` transactions on replica\n\n**Bug fixes**\n* [#12898](https://github.com/redis/redis/pull/12898) `XREADGROUP`: fix entries-read inconsistency between master and replicas\n* [#13042](https://github.com/redis/redis/pull/13042) `SORT ... STORE`: fix created lists to respect list compression and packing configs\n* [#12817](https://github.com/redis/redis/pull/12817), [#12905](https://github.com/redis/redis/pull/12905) Fix race condition issues between the main thread and module threads\n* [#12577](https://github.com/redis/redis/pull/12577) Unsubscribe all clients from replica for shard channel if the master ownership changes\n* [#12622](https://github.com/redis/redis/pull/12622) `WAITAOF` could timeout or hang if used after a module command that propagated effects only to replicas and not to AOF\n* [#11734](https://github.com/redis/redis/pull/11734) `BITCOUNT` and `BITPOS` with nonexistent key and illegal arguments return an error, not 0\n* [#12394](https://github.com/redis/redis/pull/12394) `BITCOUNT`: check for wrong argument before checking if key exists\n* [#12961](https://github.com/redis/redis/pull/12961) Allow execution of read-only transactions when out of memory\n* [#13274](https://github.com/redis/redis/pull/13274) Fix crash when a client performs ACL change that disconnects itself\n* [#13311](https://github.com/redis/redis/pull/13311) Cluster: Fix crash due to unblocking client during slot migration\n\n**Security improvements**\n* [#13108](https://github.com/redis/redis/pull/13108) Lua: LRU eviction for scripts generated with `EVAL` *** BEHAVIOR CHANGE ***\n* [#12961](https://github.com/redis/redis/pull/12961) Restrict the total request size of `MULTI ... EXEC` transactions\n* [#12860](https://github.com/redis/redis/pull/12860) Redact ACL username information and mark `*-key-file-pass configs` as sensitive\n\n\n**Performance and resource utilization improvements**\n* [#12838](https://github.com/redis/redis/pull/12838) Improve performance when many clients call `PUNSUBSCRIBE` / `SUNSUBSCRIBE` simultaneously\n* [#12627](https://github.com/redis/redis/pull/12627) Reduce lag when waking `WAITAOF` clients and there is not much traffic\n* [#12754](https://github.com/redis/redis/pull/12754) Optimize `KEYS` when pattern includes hashtag and implies a single slot\n* [#11695](https://github.com/redis/redis/pull/11695) Reduce memory and improve performance by replacing cluster metadata with slot specific dictionaries\n* [#13087](https://github.com/redis/redis/pull/13087) `SCRIPT FLUSH ASYNC` now does not block the main thread\n* [#12996](https://github.com/redis/redis/pull/12996) Active memory defragmentation efficiency improvements\n* [#12899](https://github.com/redis/redis/pull/12899) Improve performance of read/update operation during rehashing\n* [#12536](https://github.com/redis/redis/pull/12536) `SCAN ... MATCH`: Improve performance when the pattern implies cluster slot\n* [#12450](https://github.com/redis/redis/pull/12450) `ZRANGE ... LIMIT`: improved performance\n\n\n**Other general improvements**\n* [#13133](https://github.com/redis/redis/pull/13133) Lua: allocate VM code with jemalloc instead of libc and count it as used memory *** BEHAVIOR CHANGE ***\n* [#12171](https://github.com/redis/redis/pull/12171) `ACL LOAD`: do not disconnect all clients *** BEHAVIOR CHANGE ***\n* [#13020](https://github.com/redis/redis/pull/13020) Allow adjusting defrag configurations while active defragmentation is running\n* [#12949](https://github.com/redis/redis/pull/12949) Increase the accuracy of avg_ttl (the average keyspace keys TTL)\n* [#12977](https://github.com/redis/redis/pull/12977) Allow running `WAITAOF` in scripts\n* [#12782](https://github.com/redis/redis/pull/12782) Implement TCP Keep-Alives across most Unix-like systems\n* [#12707](https://github.com/redis/redis/pull/12707) Improved error codes when rejecting scripts in cluster mode\n* [#12596](https://github.com/redis/redis/pull/12596) Support `XREAD ... BLOCK` in scripts; rejected only if it ends up blocking\n\n**New metrics**\n* [#12849](https://github.com/redis/redis/pull/12849) `INFO`: `pubsub_clients` - number of clients in Pub/Sub mode\n* [#12966](https://github.com/redis/redis/pull/12966) `INFO`: `watching_clients` - number of clients that are watching keys\n* [#12966](https://github.com/redis/redis/pull/12966) `INFO`: `total_watched_keys` - number of watched keys\n* [#12476](https://github.com/redis/redis/pull/12476) `INFO`: `client_query_buffer_limit_disconnections` - count client input buffer OOM events\n* [#12476](https://github.com/redis/redis/pull/12476) `INFO`: `client_output_buffer_limit_disconnections` - count client output buffer OOM events\n* [#12996](https://github.com/redis/redis/pull/12996) `INFO`: `allocator_muzzy` - memory returned to the OS but still shows as RSS until the OS reclaims it\n* [#13108](https://github.com/redis/redis/pull/13108) `INFO`: `evicted_scripts` - number of evicted eval scripts. Users can check it to see if they are abusing EVAL\n* [#12996](https://github.com/redis/redis/pull/12996) `MEMORY STATS`: `allocator.muzzy` - memory returned to the OS but still shows as RSS until the OS reclaims it\n* [#12913](https://github.com/redis/redis/pull/12913) `INFO MEMORY` `mem_overhead_db_hashtable_rehashing` - memory resharding overhead (only the memory that will be released soon)\n* [#12913](https://github.com/redis/redis/pull/12913) `MEMORY STATS`: `overhead.db.hashtable.lut` - total overhead of dictionary buckets in databases\n* [#12913](https://github.com/redis/redis/pull/12913) `MEMORY STATS`: `overhead.db.hashtable.rehashing` - temporary memory overhead of database dictionaries currently being rehashed \n* [#12913](https://github.com/redis/redis/pull/12913) `MEMORY STATS`: `db.dict.rehashing.count` - number of top level dictionaries currently being rehashed\n* [#12966](https://github.com/redis/redis/pull/12966) `CLIENT LIST`: `watch` - number of keys each client is currently watching\n\n**Modules API**\n* [#12985](https://github.com/redis/redis/pull/12985) New API calls: `RM_TryCalloc` and `RM_TryRealloc` - allow modules to handle memory allocation failures gracefully\n* [#13069](https://github.com/redis/redis/pull/13069) New API call: `RM_ClusterKeySlot` - which slot a key will hash to\n* [#13069](https://github.com/redis/redis/pull/13069) New API call: `RM_ClusterCanonicalKeyNameInSlot` - get a consistent key that will map to a slot \n* [#12486](https://github.com/redis/redis/pull/12486) New API call: `RM_AddACLCategory` - allow modules to declare new ACL categories\n\n\n**Configuration parameters**\n* [#12178](https://github.com/redis/redis/pull/12178) New configuration parameters: `max-new-connections-per-cycle` and `max-new-tls-connections-per-cycle` to limit the number of new client connections per event-loop cycle\n* [#7351](https://github.com/redis/redis/pull/7351) Rename some CPU configuration parameters for style alignment. Added alias to the old names to avoid breaking change\n\n**CLI tools**\n* [#10609](https://github.com/redis/redis/pull/10609) redis-cli: new `-t ` argument: specify server connection timeout in seconds\n* [#11315](https://github.com/redis/redis/pull/11315) redis-cli: new `-4` and `-6` flags to prefer IPV4 or IPV6 on DNS lookup\n* [#12862](https://github.com/redis/redis/pull/12862) redis-cli: allows pressing up arrow to return any command (including sensitive commands which are still not persisted)\n* [#12543](https://github.com/redis/redis/pull/12543) redis-cli: add reverse history search (like Ctrl+R in terminals)\n* [#12826](https://github.com/redis/redis/pull/12826) redis-cli: add `--keystats` and `--keystats-samples` to combines `--memkeys` and `--bigkeys` with additional distribution data\n* [#12735](https://github.com/redis/redis/pull/12735) redis-cli: fix: `--bigkeys` and `--memkeys` now work on cluster replicas\n* [#9411](https://github.com/redis/redis/pull/9411) redis-benchmark: add support for binary strings\n* [#12986](https://github.com/redis/redis/pull/12986) redis-benchmark: fix: pick random slot for a node to distribute operation across slots" } ], "examples": [] }