Security bulletins

A remote code execution vulnerability was found in open-source Redis. As a result, all versions that Memorystore for Redis Cluster supports are impacted.

By default, clusters in Memorystore for Redis Cluster aren't exposed to the public internet, so the risk of this vulnerability is Low for Memorystore for Redis Cluster users who follow Google Cloud's security best practices.

What should you do?

Google has started applying patches automatically, with an estimated completion date of November 6, 2025. No action is required from you to receive this fix.

If you want to apply these patches to your clusters in Memorystore for Redis Cluster earlier than November 6, 2025, then use self-service maintenance to complete the following actions:

1. View the current maintenance version of your clusters in Memorystore for Redis Cluster.
2. Verify if the version matches the latest patched versions.
3. If the version isn't the latest maintenance version, then update your clusters to the latest maintenance version using self-service maintenance for Memorystore for Redis Cluster.