--- title: Security update: Redis response to the Kimi K3... description: Redis has responded to public claims by researchers who used the Kimi K3 AI model to identify 19 zero-day vulnerabilities in Redis. Of the publicly documented... canonical: https://daily.dev/posts/security-update-redis-response-to-the-kimi-k3-vulnerability-claims-pvfy7a9c4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security update: Redis response to the Kimi K3 vulnerability claims | daily.dev og:description: Redis has responded to public claims by researchers who used the Kimi K3 AI model to identify 19 zero-day vulnerabilities in Redis. Of the publicly documented... og:url: https://daily.dev/posts/security-update-redis-response-to-the-kimi-k3-vulnerability-claims-pvfy7a9c4 og:image: https://api.daily.dev/og/posts/PVfy7A9c4.png og:image:alt: Security update: Redis response to the Kimi K3 vulnerability claims og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security update: Redis response to the Kimi K3 vulnerability claims **[Redis](https://daily.dev/sources/redislabs)** · 2 min read · 0 upvotes · 1 comments ## Summary Redis has responded to public claims by researchers who used the Kimi K3 AI model to identify 19 zero-day vulnerabilities in Redis. Of the publicly documented issues, three were confirmed: a Redis Streams use-after-free, a RedisBloom TDigest out-of-bounds write, and a RedisBloom TopK RDB loader wild-free. All three had already been reported via Redis's bug bounty program by unaffiliated researchers. Redis expedited fixes, releasing Redis 8.8.1 and updates for six older branches, plus RedisBloom security releases. The TopK issue has been patched in Redis Software and Redis Cloud, with an open source fix coming soon. Users are urged to update immediately and follow recommended security practices including strong authentication and network isolation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities were fixed in Redis 8.8.1? Redis 8.8.1 fixes a Redis Streams shared-NACK use-after-free and a RedisBloom TDigest out-of-bounds write, released alongside updates for six older maintained branches and corresponding RedisBloom security releases. A third issue, a RedisBloom TopK RDB loader wild-free, has been remediated in Redis Software and Redis Cloud, with an open source fix coming soon. _Track Redis and RedisBloom patch releases on daily.dev before rolling out a production upgrade._ ### Are the 19 zero-day vulnerabilities claimed against Redis using the Kimi K3 AI model real? Only three of the claimed issues have been substantiated with technical evidence: a Redis Streams use-after-free, a RedisBloom TDigest out-of-bounds write, and a RedisBloom TopK wild-free. These were already known to Redis through its bug bounty program from unrelated researchers before the public claims surfaced, and no complete list or supporting details for the remaining alleged vulnerabilities has been published. _Follow how Redis security claims get verified and patched by checking daily.dev before reacting to disclosure headlines._ ### What security practices does Redis recommend beyond applying patches? Redis instances should use strong authentication, have access tightly restricted, and be deployed within trusted networks rather than exposed directly to the public internet. These measures reduce exposure to common attack paths but are described as complementary to, not a replacement for, timely patching of known vulnerabilities. _Operators hardening Redis deployments can keep patch and practice guidance together on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 0 upvotes > Good example of why the headline count matters less than clear triage and fast patches. Three confirmed issues is still three reasons to upgrade, and network isolation should stay in place even after the update. ## Similar posts on daily.dev - [Security Advisory: CVE-2026-81934](https://daily.dev/posts/security-advisory-cve-2026-81934-mduklgchf) · Redis · 0 upvotes · 0 comments - [CVE-2025-49844 - The Redis CVSS 10.0 vulnerability and how we responded](https://daily.dev/posts/cve-2025-49844---the-redis-cvss-10-0-vulnerability-and-how-we-responded-0y4bn4ogr) · Scott Helme · 0 upvotes · 0 comments - [Redis Critical Remote Code Execution Vulnerability Discovered After 13 Years](https://daily.dev/posts/redis-critical-remote-code-execution-vulnerability-discovered-after-13-years-qec9wkpcb) · InfoQ · 5 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#redis](https://daily.dev/tags/redis), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/security-update-redis-response-to-the-kimi-k3-vulnerability-claims-pvfy7a9c4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security update: Redis response to the Kimi K3 vulnerability claims","url":"https://daily.dev/posts/security-update-redis-response-to-the-kimi-k3-vulnerability-claims-pvfy7a9c4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-update-redis-response-to-the-kimi-k3-vulnerability-claims-pvfy7a9c4"},"datePublished":"2026-07-28T00:52:42.601Z","dateModified":"2026-09-14T06:02:18.059Z","description":"Redis has responded to public claims by researchers who used the Kimi K3 AI model to identify 19 zero-day vulnerabilities in Redis. Of the publicly documented...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9b0165b150d2fcb31adaa41c1251154a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9b0165b150d2fcb31adaa41c1251154a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Redis","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Redis","logo":"https://media.daily.dev/image/upload/s--hr1KV229--/f_auto/v1729434313/logos/redis.png","url":"https://daily.dev/sources/redislabs"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/security-update-redis-response-to-the-kimi-k3-vulnerability-claims-pvfy7a9c4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,vulnerability,redis,zero-day","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Redis","item":"https://daily.dev/sources/redislabs"},{"@type":"ListItem","position":3,"name":"Security update: Redis response to the Kimi K3 vulnerability claims"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/security-update-redis-response-to-the-kimi-k3-vulnerability-claims-pvfy7a9c4","comment":[{"@type":"Comment","text":"Good example of why the headline count matters less than clear triage and fast patches. Three confirmed issues is still three reasons to upgrade, and network isolation should stay in place even after the update.","datePublished":"2026-07-28T02:58:27.640Z","url":"https://daily.dev/posts/PVfy7A9c4#c-LgDKyThN1","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-update-redis-response-to-the-kimi-k3-vulnerability-claims-pvfy7a9c4#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities were fixed in Redis 8.8.1?","acceptedAnswer":{"@type":"Answer","text":"Redis 8.8.1 fixes a Redis Streams shared-NACK use-after-free and a RedisBloom TDigest out-of-bounds write, released alongside updates for six older maintained branches and corresponding RedisBloom security releases. A third issue, a RedisBloom TopK RDB loader wild-free, has been remediated in Redis Software and Redis Cloud, with an open source fix coming soon. Track Redis and RedisBloom patch releases on daily.dev before rolling out a production upgrade."}},{"@type":"Question","name":"Are the 19 zero-day vulnerabilities claimed against Redis using the Kimi K3 AI model real?","acceptedAnswer":{"@type":"Answer","text":"Only three of the claimed issues have been substantiated with technical evidence: a Redis Streams use-after-free, a RedisBloom TDigest out-of-bounds write, and a RedisBloom TopK wild-free. These were already known to Redis through its bug bounty program from unrelated researchers before the public claims surfaced, and no complete list or supporting details for the remaining alleged vulnerabilities has been published. Follow how Redis security claims get verified and patched by checking daily.dev before reacting to disclosure headlines."}},{"@type":"Question","name":"What security practices does Redis recommend beyond applying patches?","acceptedAnswer":{"@type":"Answer","text":"Redis instances should use strong authentication, have access tightly restricted, and be deployed within trusted networks rather than exposed directly to the public internet. These measures reduce exposure to common attack paths but are described as complementary to, not a replacement for, timely patching of known vulnerabilities. Operators hardening Redis deployments can keep patch and practice guidance together on daily.dev."}}]} ```