2009 – 2026
Redis Versions
Every release of Redis — the in-memory data-structure store used as a database, cache, and message broker — from Salvatore Sanfilippo's 2009 original through the 8.x line. Redis 8.10 (July 2026) is the current stable release; Redis is open source again under AGPLv3 since 8.0. With ship dates and the headline changes per major — Redis Cluster (3.0), the Modules API (4.0), Streams (5.0), ACLs and RESP3 (6.0), and Functions (7.0) — plus the licensing arc this page exists to explain: fifteen years of BSD, the March 2024 move to source-available licensing, and the May 2025 return to open source.
License era
BSD — 1.0 through 7.2 (2009–2023), permissive open source
Source-available — 7.4 only (RSALv2 / SSPLv1); not OSI open source
AGPL, open again — 8.0+ (tri-licensed RSALv2 / SSPLv1 / AGPLv3)
Redis publishes no formal per-version LTS / EOL matrix. In practice the latest major line gets patches, and Redis also backports critical security fixes to the last widely deployed BSD and source-available lines (7.2, 7.4) and to 6.2. Each coordinated release patches a different set of lines with a different set of fixes, so read the tags, not the range. The release of August 17, 2026 shipped eight tags in one day: 6.2.24, 7.2.16, 7.4.11, 8.2.9, 8.4.6, 8.6.6, 8.8.2, 8.10.1. Only one fix is common to all eight — a use-after-free in the TLS pending-data list (CVE-2026-81934), reached when one command closes another connection that still has buffered TLS data. Its severity has already been restated once: the record published August 27, 2026 scored it CVSS 3.1 9.8 Critical, and on August 31, 2026 the assigning authority revised that to CVSS 3.1 7.1 High (CVSS 4.0 7.5 High), re-scoring the reach as adjacent-network and privilege-requiring rather than remote and unauthenticated — though the record's own description still reads “remote, unauthenticated.” Redis's own advisory is why the number moved: it says the flaw takes an authenticated attacker, rates the bug High, states that Redis asked the assigning authority to re-review the original score, and reports no known exploitation as of August 27, 2026. A second use-after-free, in the blocked-client list, reached every line but 6.2. An ACL key-permission bypass in SORT, GEORADIUS and XREAD reached 7.2, 7.4, 8.2, 8.4, 8.6 and 8.8, and a separate out-of-bounds access in the ACL key-extraction path stopped at 7.2, 7.4, 8.2 and 8.4. A crafted-RDB SLOT_INFO memory corruption that may allow remote code execution reached 7.4 and every 8.x line, and the 8.x lines alone got a CMSketch heap out-of-bounds write (CVE-2026-62356), an out-of-bounds access in the TopK cleanup path, and three Vector Sets fixes. Narrower still: only 8.6, 8.8 and 8.10 got the TLS client-certificate authentication bypass fix — a certificate Common Name carrying an embedded NUL byte was truncated, letting a client authenticate as a different and possibly privileged ACL user. Those eleven fixes are the whole August set. It followed the July 23, 2026 release, which fixed a crafted-stream RESTORE use-after-free (CVE-2026-66373, CVSS 7.5 High) in 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5 and 8.6.5 — the 8.8 line already carried it from 8.8.0 — plus a crafted-RESTORE out-of-bounds write in the Bloom-filter and t-digest types across all four 8.x lines. Redis 8.0 was skipped by both. Its last patch is 8.0.6 (February 2026), so not one of those fixes reached an 8.0.x install — the TLS use-after-free, the one bug every other supported line was patched for, included — even though endoflife.date still lists the 8.0 line as supported to December 2026 — do not read “Redis patches its supported lines” as covering 8.0. The table below lists one row per major / feature minor; the current stable tip (8.10, July 2026; patch tip 8.10.1) rides on top of the 8.0 line. Per-version release notes live in the GitHub release tags; endoflife.date keeps a support-window view.
The 2009 origin and the antirez lineage
Redis began in 2009 as a project by the Italian developer Salvatore Sanfilippo, known online as antirez. He built it to scale the real-time analytics of his own startup, needing an in-memory store with richer values than a plain cache — not just strings, but lists, sets, and hashes as first-class server-side data structures. He open-sourced it under the permissive BSD license, and the name is a contraction of “REmote DIctionary Server.”
Commercial stewardship passed through several hands while the project stayed BSD and Sanfilippo stayed lead maintainer: VMware sponsored his full-time work on Redis from 2010, then Pivotal, and from 2015 the company Redis Labs — later renamed Redis Ltd., still the name on its own license page — became the primary sponsor and trademark holder. Sanfilippo led development until 2020, when he stepped back from day-to-day maintenance and handed the project to a core team.
Redis grew into one of the most widely deployed pieces of infrastructure on the internet — a default choice for caching, session storage, rate limiting, queues, leaderboards, and pub/sub. Its single-threaded command execution (I/O was threaded only in 6.0) is a deliberate design choice: every command is atomic, which makes reasoning about concurrency simple and is a large part of why Redis is fast and predictable.
The build-out — from key-value cache to data platform
The version history reads as a steady widening of what Redis is. It started as an in-memory store for a handful of data structures with snapshot persistence, and each major added a capability that moved it further from “just a cache.” Redis Cluster (3.0) made it horizontally scalable with automatic sharding and failover. The Modules API (4.0) let third parties bolt on whole new data types — search, JSON, time series, probabilistic structures — which grew into the “Redis Stack” distribution.
Streams (5.0) added a persistent log with consumer groups, pulling queue and event-sourcing workloads onto Redis. 6.0 brought the plumbing a serious data platform needs — ACLs, the RESP3 protocol, TLS, threaded I/O, and client-side caching — and Functions (7.0) replaced ad-hoc Lua scripts with named, replicated server-side libraries that are part of the dataset.
That arc closed a loop at 8.0: the Stack modules that started as external add-ons in 4.0 — JSON, Time Series, probabilistic types, the Query Engine, and the new Vector Sets — folded back into core Redis. What began as a key-value cache in 2009 is now a multi-model data platform that also does documents, search, vectors, and time series in one process.
Is Redis open source? The 2024 relicensing and the 2025 return
Redis was BSD-licensed open source for its entire first fifteen years — every release from 1.0 through 7.2. By the early 2020s, Redis Ltd.'s commercial concern was the same one MongoDB, Elastic, and HashiCorp had already acted on: cloud providers offering managed Redis as a service and capturing much of the revenue without contributing back to the project.
On March 20, 2024, Redis Ltd. relicensed the core, effective with Redis 7.4, from BSD to a dual source-available model: the Redis Source Available License v2 (RSALv2) and the Server Side Public License (SSPLv1). Neither is approved by the Open Source Initiative — RSALv2 forbids offering the software as a competing managed service, and SSPL's service-source-disclosure condition has never been OSI-certified — so by the OSI's bar, Redis 7.4 is “source-available, not open source.” Versions 7.2.x and earlier remain BSD. The move prompted Valkey, a community fork off the still-BSD 7.2 line.
The direction reversed within a year. Sanfilippo returned to Redis in late 2024 and, by his own account, argued internally for reopening the source. Redis 8.0 (May 2025) added the OSI-approved AGPLv3 as a third license option, so Redis is once again open source — now tri-licensed RSALv2 / SSPLv1 / AGPLv3, with users free to choose the AGPL and treat Redis as OSI open source. The same release folded the former Redis Stack modules into core under the same license.
The fair summary is that the “is Redis open source?” question has a different answer for each of three periods, which is exactly why the badges and dividers in the table above are keyed to license rather than to features: BSD open source through 7.2, source-available at 7.4, and AGPLv3 open source again from 8.0. Sanfilippo has framed the reopening as a return to Redis's roots; critics have argued it came only after the fork cost Redis momentum. This page states what changed and when, and points to the primary texts — the Redis license page and antirez's own blog — rather than adjudicating who was right.