Snapshot 256479
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Welcome to the Redis Trust Center! We believe that security, privacy, and transparency is foundational to how we operate and build trust with our community. Our Trust Center is designed to provide centralized, on-demand access to our latest security documentation, compliance certifications, and foundational materials. You can explore our most frequently requested security and compliance documents at the links below. SOC 2 Type 2 Report ISO 27001 Certificate ISO 42001 Certificate ISO / CSA STAR Summary Report Redis Cloud Whitepaper Additional Resources Customer Support Knowledgebase Product Documentation Service Status & Availability Redis Legal Hub If you have additional questions regarding our security posture or compliance programs, our teams are available to assist you. Certifications & Compliance CCPA CSA STAR GDPR HIPAA ISO 22301 ISO 9001:2015 ISO/IEC 27001 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701:2019 ISO/IEC 42001:2023 PCI DSS SOC 2 VPAT FIPS 140-3 Redis is reviewed and trusted by JetBlue British Airways Mercedes-Benz Capital One Adobe Uber Policies Acceptable Use Policy Access Control Policy Asset Management Policy View more Legal & Privacy Subprocessors Data Processing Addendum Legal Notices Library View more Cloud Security Audit Logging Integrations Multi-Factor Authentication View more Reports Pentest Report Security Whitepaper STIG Self-Assessments CAIQ CISA SSDF Attestation Data Security Data Backups Encryption-at-rest Encryption-in-transit App Security Responsible Disclosure Code Reviews Software Development Lifecycle View more AI AI Overview AI Training Data and Bias AI Security View more Data Privacy Cookies Data Breach Notifications Data Privacy Officer View more Access Control Data Access Logging Password Security Infrastructure Status Monitoring Amazon Web Services Azure View more Endpoint Security Anti-Malware Disk Encryption Endpoint Detection & Response View more Network Security Data Loss Prevention IDS/IPS Traffic Protection View more Corporate Security Employee Training HR Security Incident Response View more Security Grades Qualys SSL Labs redis.io A app.redislabs.com A+ Trust Center Updates CVE-2026-111497 (Critical) Vulnerabilities Redis is aware of CVE-2026-111497, a third-party vulnerability affecting the Brotli decompression library in Node.js. CVE-2026-111497 Redis Open Source: has been confirmed as not affected. Redis Software: we are preparing security updates for the affected versions and proactively reaching out to impacted customers with mitigation guidance. Customers running Redis Software should review and ensure they are following Redis recommended security configuration guidance. Ensuring access to each interface restricted to trusted networks and not accessible to the public internet. We will share confirmed affected versions, security update availability, and further remediation guidance as they become available. If you need assistance reviewing your deployment or management access configuration, please contact Redis Support or your account team. What Recent PHP Vulnerabilities Mean for Redis Customers Vulnerabilities The recently disclosed PHP vulnerabilities affect PHP runtime and PHP-based applications. They do not represent a vulnerability in the Redis server or Redis Cloud service. Customers that operate PHP applications which connect to Redis should follow the PHP project's security guidance, apply the applicable PHP updates, and review the application's access to Redis. What happened? The PHP project recently disclosed two critical CVEs, CVE-2026-109618 and CVE-2026-109619. These issues may allow an unauthenticated attacker to compromise a vulnerable PHP application, depending on the application's exposure, configuration, and deployment environment. Does this affect Redis? Redis has reviewed the issue against the architecture of its products and services. Redis Enterprise Software: Redis Enterprise does not contain PHP components. Redis Cloud: Redis Cloud's core service does not use PHP. Redis Community Edition, Redis OSS, and Redis Stack: The Redis server does not embed the PHP runtime. PHP applications connected to Redis: A vulnerable PHP application could potentially be used to access Redis with the permissions and credentials available to that application. This is an application-layer risk and should be assessed separately from the security of the Redis server. What action is required for Redis customers? No Redis product upgrade is required solely because of these PHP vulnerabilities. Customers should patch PHP wherever it is deployed in their own application environment, including any PHP application that connects to Redis. Redis Cloud customers do not need to take action within Redis Cloud for this issue. They should still patch and secure any PHP applications they operate outside the Redis Cloud service. Our ongoing approach Redis will continue to monitor the PHP project's security guidance and assess any newly published information for changes to this analysis. If the scope changes, Redis will provide updated guidance through its official security communications channels. For questions about a specific Redis deployment, customers should contact Redis Support or their designated Redis security contact. CVE-2026-81934 (High) Vulnerabilities As part of an ongoing effort by the Redis Community and Redis to maintain Redis safety, security, and compliance posture, a security vulnerability has been identified and remediated. CVE-2026-81934 (High) Note: the public CVE record initially scored this vulnerability 9.8 (Critical). Redis assesses it as 7.5 (High) based on the access, permissions, coordination, and runtime conditions required for exploitation. Redis has requested a review of the public score. Update 9/1/2026: following further review, the public CVE for CVE-2026-81934 was updated to reflect a revised CVSS score of 7.5 (High). Fixed Redis Open Source releases: 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, and 6.2.24 Fixed Redis Software builds: 8.2.0-46, 8.0.20-96, 7.22.2-179, and 7.8.6-303 Redis Cloud Essentials has been patched. Remediation of Redis Cloud Pro is underway as of the time of this posting; customers requiring expedited maintenance should contact their Technical Account Manager. We encourage all Redis Software, Redis Community Edition, Redis OSS, and Redis Stack customers to update to a release that include the fix per the cadence required by their security best practices in light of the CVE severity. For additional information, please refer to the Redis Security Advisory. We thank the security research community for helping us keep Redis secure! CVE-2026-62356 (High) Vulnerabilities As part of an ongoing effort by the Redis Community and Redis to maintain Redis safety, security, and compliance posture, a security vulnerability in Redis has been identified and remediated. CVE-2026-62356 (High) If you’re a Redis Cloud customer, your Redis instance is protected against this vulnerability, as we’ve already upgraded our Redis Cloud services with the fix. We encourage all Redis Software, Redis Community Edition, Redis OSS, and Redis Stack customers to upgrade to a release that includes the fix per the cadence required by their security best practices in light of the CVE severity. For more detailed information on the issue, please refer to the Redis Security Advisory. We thank the security research community for helping us keep Redis secure! CVE‑2026‑23479 (High), CVE‑2026‑25243 (High), CVE-2026-25588 (High), CVE‑2026‑25589 (High), CVE-2026-23631 (Medium) Vulnerabilities Title: CVE‑2026‑23479 (High), CVE‑2026‑25243 (High), CVE-2026-25588 (High), CVE‑2026‑25589 (High), CVE-2026-23631 (Medium) As part of an ongoing effort by the Redis Community and Redis to maintain Redis safety, security, and compliance posture, five security vulnerabilities in Redis have been proactively identified and remediated. The vulnerabilities are: CVE‑2026‑23479 (High), CVE‑2026‑25243 (High), CVE-2026-25588 (High), CVE‑2026‑25589 (High), CVE-2026-23631 (Medium) For additional information, please refer to: https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631 If you’re a Redis Cloud customer, your Redis instance is protected against these vulnerabilities, as we’ve already upgraded our Redis Cloud service with the fixes. We encourage all Redis Software, Redis Community Edition, Redis OSS, and Redis Stack customers to upgrade to a release that includes the fix per the cadence required by their security best practices in light of the CVE severity. We thank the security research community for helping us keep Redis secure! If you think you may have discovered a vulnerability, please send us a note. Report issue