The Redis and Valkey CVE Register, 2026 Edition

Severity is the rating published in each GitHub security advisory, which is the CNA record for these projects. NVD sometimes scores the same CVE higher; CVE-2024-46981, for example, is 7.0 High in the Redis advisory and 9.8 Critical in NVD's own analysis. Where the ratings differ this register keeps the advisory's, as the RabbitMQ register does. The same bug can also be rated differently by each project: Valkey rates CVE-2025-49844 High (8.8) where Redis rates it Critical (9.9).

Disclosure has been steady rather than bursty: 11 in 2025 and 11 so far in 2026. The 2026 rows come in batches. Redis published three redis-server CVEs and two module CVEs together on 5 May 2026, several of them found during the Wiz Zeroday Cloud event, and Valkey released fixes for the same three redis-server bugs the following day. Lua scripting is the single largest source: six of the 14 redis-server CVEs are in the Lua engine or reachable only through scripts.

Each row counts the CVEs in this register that affected a release of that series, and how many of them a later release in the same series fixed. A series that shipped after a fix landed, such as 8.4 for the 2025 Lua bugs, is not counted as affected. Redis 6.2 has had every applicable fix backported, most recently 6.2.24 in August 2026, and remains supported until 1 April 2027. Redis 7.0 left support in 2024 and shows 12 affected and none fixed. Redis 8.0 shows 6 unfixed: three redis-server CVEs from May 2026 and three module CVEs, all fixed on 8.2 and later. The latest-release column is the version to run, not merely the first fix.

Valkey's policy is three years of maintenance from each minor release's first release, and five years of security support for the last minor of each major. Every series below is inside that window, and every CVE that affected a series has a fixed release on it. Valkey 7.2 and 8.0 carry the most CVEs because they predate most fixes; 9.1 shipped with the May 2026 fixes already in it. Note that Valkey 8.0.8 was revoked because its tag was placed on the wrong commit; use 8.0.9 or later.

Affected ranges and fixed releases are quoted from the project advisories and release notes. A fixed release is the floor, not the target: later releases in the same series include every earlier fix. "No fix" means the series was affected and no release on it contains the fix. Redis 8 modules apply to Redis 8.0 and later, where the probabilistic and time series types ship in the core distribution, and to Redis Stack builds that load the module.

The CVE list is not the whole security picture. From February 2026 Redis release notes list several security fixes with no CVE identifier, and Valkey published two advisories in August 2026 without one. Two of the Redis fixes have descriptions that match Valkey CVEs: the July 2026 stream RESTORE fix matches CVE-2026-63639, and the August 2026 TLS pending-data fix matches CVE-2026-56684. Treat these releases as security updates even though a CVE scanner will not flag the older build.

Neither project patches a series after its end of life, and the register shows what that costs. Redis 7.0 is the clearest case: 12 of the 14 redis-server CVEs here affect it, including RediShell, and 7.0.15 will not be followed by 7.0.16. Redis 6.2 is protected today and has fixes as recent as August 2026, but its end of life is 1 April 2027; any flaw disclosed after that date stays open on 6.2. Redis 8.0, a standard release, reaches end of life on 1 December 2026 and in practice stopped receiving fixes in February 2026, so an 8.0 deployment should move to 8.2, the extended release supported to 1 September 2030. Upgrading from 6.2 or 7.0 to 7.4 or later also changes the license, from BSD-3-Clause to RSALv2 or SSPLv1 (or AGPLv3 from Redis 8), which is why some teams choose Valkey instead.

Where an upgrade cannot happen before the next disclosure, the options are a backport or compensating controls. Most rows here have an advisory workaround: ACL rules that deny EVAL, EVALSHA and FUNCTION, RESTORE, HyperLogLog or XACKDEL, plus network controls that keep unauthenticated clients off the port. AceMQ's OSSeva service publishes patched builds of Redis 6.2, 7.0 and 7.2 and Valkey 7.2 and 8.x, including Redis 7.0, which receives no upstream fixes, and 6.2 after 1 April 2027. For incident response and upgrade planning on the version you run, see Redis support and Valkey support.

Sources. The GitHub security advisories of redis/redis, valkey-io/valkey, RedisBloom/RedisBloom and RedisTimeSeries/RedisTimeSeries; the GitHub release notes of redis/redis and valkey-io/valkey, which give the fixed release in each series; NVD for every CVE identifier; redis.io version management and valkey.io release policy for support dates. Every CVE ID in the register resolves on NVD or in a GitHub advisory; CVE-2026-62356 was not yet on NVD on the date checked and is cited from its GitHub advisory.

Scope. CVEs with a publication date from 1 January 2025 to 9 October 2026, which brings in two 2024 identifiers published in January 2025. Redis Software (Redis Enterprise), Redis Cloud and the managed cloud services patch on their own schedules and are out of scope; check the vendor's bulletin. Client libraries are not tracked.

Date checked. 9 October 2026. New advisories publish without notice, so check the live advisory pages before a compliance submission. This page is re-issued when a new Redis or Valkey CVE is published.