Redis and Valkey: patch and never expose to the internet

Updated November 2026

Redis and Valkey are built for trusted clients on a trusted network. Anyone who can reach port 6379 on an open instance can delete every key with one command, or abuse CONFIG to plant files on the server. Keep them bound to localhost or a private address, require a password, and install the October 26, 2026 security releases.

8.10.3Newest Redis, security fix, October 26, 2026
9.1.3 / 9.0.7Newest Valkey releases, October 26–27, 2026
6379Default port: never reachable from the internet

What they are

Redis is an in-memory key-value store that applications use as a cache, session store, message broker and job queue. Valkey is a separate open-source project, built on the BSD-licensed Redis code and hosted under the Linux Foundation (its trademarks belong to LF Projects, LLC). It works with existing Redis clients. Some distributions have switched: Fedora replaced Redis with Valkey because Redis changed its license, and RHEL 10 ships a valkey package. Debian 13 and Ubuntu 24.04 offer both. Patching and hardening work the same way for both, so this page covers them together.

Check the installed version

redis-server --version
redis-cli INFO server | grep -E '^(redis_version|uptime_in_seconds)'
valkey-server --version
valkey-cli INFO server | grep -E '^(valkey_version|uptime_in_seconds)'

If the server requires a login, add --user NAME --askpass to the redis-cli command. Valkey also reports a redis_version field so that old clients keep working, so read valkey_version instead. To see where the package came from, run apt policy redis-server valkey-server, rpm -q redis valkey, apk policy redis valkey or pkg info redis valkey.

Supported versions

The Redis security policy says that security fixes are generally backported to one previous major version. Its table currently lists these lines as supported:

Redis Open Source support, as of November 3, 2026
Line	Supported	Latest release
8.10	Yes	8.10.3 (Oct 26, 2026)
8.8	Yes	8.8.4 (Oct 26, 2026)
8.6	Yes	8.6.8 (Oct 26, 2026)
8.4	Yes	8.4.8 (Oct 26, 2026)
8.2	Yes	8.2.11 (Oct 26, 2026)
8.0	No	—
7.4	Yes	7.4.12 (Oct 26, 2026)
7.2	Extended until 7.4 support ends	7.2.17 (Oct 26, 2026)
6.2	"Support extended"	Check the releases page
Older than 7.2 (except 6.2)	No	—

Valkey lists five supported series on its download page: 9.1 (9.1.3), 9.0 (9.0.7), 8.1 (8.1.11), 8.0 (8.0.12) and 7.2 (7.2.15). Valkey does not publish end-of-life dates. Release candidates such as 9.2.0-rc1 are not for production.

The October 26 releases of both projects fix the same kind of flaw. An integer truncation when building large cluster-bus PUBLISH messages causes a heap buffer overflow. Valkey rates it High. Earlier in 2026, Valkey fixed several High-rated use-after-free bugs (memory used after it was freed), including one in the Lua script debugger that needs no login. Update to the latest release of your line.

Distro packages or upstream

Distributions freeze a version and backport fixes into it. For example, Debian 13 ships Redis 8.0.2. Upstream no longer supports 8.0, but Debian patches its own package through security updates. Ubuntu 24.04 ships Redis 7.0.15 and Valkey 7.2. On Ubuntu 22.04 and 24.04, these packages are in the universe component, which gets security fixes through Ubuntu Pro (see Ubuntu). Alpine 3.24 ships Redis 8.8 and Valkey 9.0.

Redis also runs its own APT repository, packages.redis.io, which always installs the newest Redis release:

sudo apt-get install lsb-release curl gpg
curl -fsSL https://packages.redis.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg
sudo chmod 644 /usr/share/keyrings/redis-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/redis.list
sudo apt-get update

To stay on one line, pin it with an APT preferences file (for example Pin: version 6:8.10.*). Valkey has no official distro repository. Use your distribution's package or the valkey/valkey Docker image.

Update commands

# Debian, Ubuntu
sudo apt update
sudo apt install --only-upgrade redis-server redis-tools     # or valkey-server valkey-tools

# RHEL 9
sudo dnf upgrade --refresh redis
# RHEL 10, Fedora
sudo dnf upgrade --refresh 'valkey*'

# SUSE
sudo zypper refresh
sudo zypper update redis

# Alpine (as root)
apk -U upgrade redis              # or valkey

# FreeBSD (as root)
pkg upgrade redis                 # or valkey

# Docker: pull the same line tag, then recreate the container
docker pull redis:8.10            # or valkey/valkey:9.0
docker compose up -d

Restart and verify

Redis has no reload for a new binary, so you need a full restart. During the restart, clients briefly lose their connection. With RDB or AOF persistence switched on, Redis saves to disk at shutdown and loads the data again at start. Without persistence, a restart empties it. That is fine for a pure cache, but sessions and queues are lost. These commands restart the service:

sudo systemctl restart redis-server        # Debian, Ubuntu (valkey-server for Valkey)
sudo systemctl restart redis               # RHEL 9 (valkey on RHEL 10, Fedora)
rc-service redis restart                   # Alpine, as root
service redis restart                      # FreeBSD, as root

With replication, restart the replicas first, then fail over (with Sentinel or Cluster) and restart the old primary. Afterwards, check the version and uptime again with INFO server, and look for startup errors with journalctl -u redis-server -n 50.

Lock down the network

Each layer still protects you if another one fails, for example after a config change.

The default redis.conf and valkey.conf contain bind 127.0.0.1 -::1 and protected-mode yes. In protected mode, a server that listens on all interfaces without a password answers only local clients. But admins often switch both off to "make it work", and many container setups publish port 6379. Check what is really listening and what the settings are:

sudo ss -tlnp | grep -E ':6379\b'
redis-cli CONFIG GET bind
redis-cli CONFIG GET protected-mode
redis-cli ACL LIST          # "user default on nopass" means no password at all

An open instance is a common way into a server. Attackers wipe or ransom the data, or use CONFIG SET dir and dbfilename to write files such as SSH keys or cron jobs, and then install cryptominers (cryptojacking). If that may have happened, follow cryptominer cleanup. To add passwords, create named users with ACLs (access control lists), then switch off the password-less default user:

ACL GENPASS                                         # prints a strong random secret
ACL SETUSER admin on >ADMIN-SECRET ~* &* +@all
ACL SETUSER app on >APP-SECRET ~* &* +@all -@dangerous
ACL SETUSER default off
CONFIG REWRITE                                      # or ACL SAVE if you use an aclfile

Run these from a redis-cli session. Test a login as admin before you switch off default. Connections that are already open keep working, but new ones must authenticate. -@dangerous blocks FLUSHALL, CONFIG, KEYS, INFO and similar commands. If your client library needs one of them, add it back, for example +info. The older single-password option, requirepass, sets a password for the default user.

Where advisories appear

Redis releases on GitHub: each release has an "Update urgency" line, and SECURITY marks security fixes. The releases feed works in any feed reader. The supported-versions table is in SECURITY.md.
Valkey security advisories and the Valkey releases feed. Report Valkey issues to security@lists.valkey.io.
Your distribution's tracker for backported fixes, and our vulnerability pages.

Quick hardening tips

Keep bind 127.0.0.1 -::1, or a private address only, and keep protected-mode yes.
Firewall 6379, and the cluster-bus port if you run a cluster. In Docker, publish as 127.0.0.1:6379:6379 or not at all. See firewall basics.
Use ACL users with secrets from ACL GENPASS, and switch off the default user.
Block dangerous commands for application users with ACLs. The rename-command option is deprecated.
Run as the unprivileged redis or valkey user, never as root.
Turn on TLS if traffic leaves the host. Without it, passwords travel in clear text.
Turn on persistence or keep backups for any data you cannot rebuild.