Redis 7.2 end of life
Redis 7.2 is supported until 1 December 2029. redis.io lists it as an extended release, which receives security updates and critical bug fixes for five years. 7.2.0 shipped on 15 August 2023 and the latest release is 7.2.16, from 17 August 2026. 7.2 is the last Redis line under the BSD-3-Clause licence; 7.4 and later use other licences.
- End of life
- 1 December 2029
- Released
- Aug 2023
- Final release
- 7.2.16 (latest, 17 August 2026)
- Successor
- Redis 8.2 (to 1 September 2030), or Valkey
Date published by Redis Open Source version management. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 1 December 2029
- Nothing yet. Redis ships security releases on 7.2 regularly: 7.2.11 fixed CVE-2025-49844, a Lua use-after-free that NVD rates 9.9, and 7.2.14 fixed CVE-2026-23479 and two other remote code execution issues.
- On 1 December 2029, security updates and critical bug fixes for 7.2 end, along with 7.4 on the same date.
- The BSD-3-Clause licence does not carry forward. Redis 7.4 moved to RSALv2 or SSPLv1, and Redis 8 added AGPLv3 as a third option.
What actually breaks in the upgrade
Stay current on 7.2.x
Supported does not mean patched. 7.2.16, from August 2026, fixed use-after-free and ACL permission bypass issues. A 7.2 cluster below 7.2.14 is missing fixes for three remote code execution CVEs.
The licence decides the target
Moving to Redis 7.4 or 8.x changes the licence, which needs a legal review before the engineering work. Teams that need BSD-3-Clause beyond 7.2 look at Valkey, which is licensed BSD-3-Clause and was forked from the Redis 7.2 line.
Avoid 8.0 as a target
redis.io lists Redis 8.0 as a standard release ending on 1 December 2026. If Redis 8 is the target, use 8.2, an extended release supported to 1 September 2030.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Stay on 7.2 and keep patching | Upstream 7.2.x security releases to 1 December 2029. | Hours per release | Engineering time | The easy option for now, if you take the security releases as they ship. |
| Upgrade to Redis 8.2 | A licence change and a major version upgrade. | Weeks | Engineering time and legal review | Supported to September 2030, on Redis's current licence terms. |
| Migrate to Valkey | A BSD-3-Clause fork of the 7.2 line. | Weeks | Engineering time | Keeps a permissive licence. Test clients, modules and persistence first. |
| OSSeva supported 7.2 | Signed BSD-3-Clause 7.2 builds with operations and compliance cover. | Days | Subscription | One supplier now and after 2029, with no licence change. |
What OSSeva does for Redis 7.2
OSSeva patches this line
OSSeva covers Redis 7.2 today on the Patch, Assure and Operate tiers, with signed builds under the original BSD-3-Clause licence that track the upstream 7.2.x security releases. Patched 7.2 builds continue after 1 December 2029, with no change of supplier or licence.
Redis extended supportWhat your auditor will say
Every system component in the cardholder data environment needs its applicable security patches. A component with no upstream fix supply needs a patched source or a documented compensating control.
Auditors ask for evidence that production systems receive security fixes. A version past end of life fails that test unless another supplier ships the fixes and can show which CVEs they close.
Redis 7.2: common questions
When does Redis 7.2 reach end of life?
On 1 December 2029, according to redis.io. Redis 7.4 ends on the same date.
Is Redis 7.2 open source?
Yes. Redis 7.2 is licensed BSD-3-Clause. Redis 7.4 and later are under RSALv2 or SSPLv1, and Redis 8 adds AGPLv3 as an option.
What is the latest Redis 7.2 release?
7.2.16, released on 17 August 2026 with security fixes.
Which CVEs were fixed in Redis 7.2?
Among others, CVE-2025-49844 in 7.2.11 and CVE-2026-23479 in 7.2.14. Both are use-after-free issues that can lead to remote code execution.
Should I move from Redis 7.2 to Valkey?
If you need a BSD-3-Clause licence after 2029, Valkey is the usual choice. If the licence is not a concern, Redis 8.2 is supported to 1 September 2030.
Still running Redis 7.2?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.