RedisTwo questions at once: the version and the licence
Redis moved from BSD to RSALv2 and SSPLv1 in March 2024, and Redis 8 added AGPLv3 as a third option. Teams on an older Redis line now face a version decision and a licensing decision in the same conversation, owned by different people.
Challenge
The licence change applies to versions released after it. Redis 7.2 and earlier stay under BSD-3-Clause; 7.4 and later use the new licences. The older BSD lines are the ones running out of fixes: Redis 7.0 reached end of life on 29 July 2024 at 7.0.15, and Redis Open Source 6.2 reaches end of life on 1 April 2027. Redis is written in C, and memory-safety advisories in command processing are the recurring class, reachable from any client that can issue the command. CVE-2025-49844, an authenticated remote code execution flaw scored 9.9 by NVD, was fixed on 6.2 in 6.2.20.
Upgrading Redis is usually easy. Deciding what to upgrade to is not. Staying on BSD means Redis 7.2, supported to 1 December 2029, or Valkey, the Linux Foundation fork of Redis 7.2.4 that remains BSD-licensed. Moving forward means accepting RSALv2, SSPLv1 or AGPLv3, which is a legal decision, while the CVE deadline is an engineering one.
Environment
Self-managed Redis 6.2 or 7.0 under the original BSD licence, used as a cache, session store or queue, with Redis Cluster or Sentinel for availability.
Legal has not yet decided whether the newer licences fit, and some services may embed Redis in a product offered to third parties. Redis is often left out of the formal software inventory because it is treated as just a cache, which is itself a finding in a SOC 2 review.
Options
Upgrade to Redis 7.2. Still BSD-licensed and supported to 1 December 2029. For most estates this is the cheapest, cleanest move, and OSSeva will say so.
Upgrade to Redis 7.4 or 8.x. RSALv2 and SSPLv1 restrict offering Redis as a commercial managed service to third parties; internal enterprise use is unaffected. Check whether the restriction applies before ruling it out.
Migrate to Valkey. BSD-licensed and wire-compatible at the fork point. Right when you offer Redis as a service to others, or when BSD licensing is a procurement requirement.
Stay on 6.2 or 7.0 with patched builds. Real when an appliance, an ISV product or an audit freeze pins the version and the licence decision needs time.
Approach
OSSeva patches Redis 6.2.x and 7.0.x under their original BSD licence, so the security deadline and the licensing decision stop being the same deadline. OSSeva Patch includes quarterly CVE patches with priority on heap overflow and memory corruption fixes, GPG-signed artifacts, and delivery through Docker, apt or yum. The builds are binary-compatible with upstream and run Redis Cluster, Sentinel and standalone mode unchanged.
OSSeva also supports Redis 7.2.x and Valkey 7.2.x and 8.x, so the destination is covered under the same contract whichever way the licence decision goes. OSSeva Assure adds an ACL and authentication audit, persistence and TLS configuration reviews, and a SOC 2 and PCI DSS attestation package. OSSeva Operate adds 24/7 monitoring, eviction and replication-lag alerting and a 15-minute P1 incident response SLA.
When the upgrade does happen, the risk is rarely the version bump. It is RDB and AOF persistence under memory pressure during the transition, so the plan checks memory headroom on each instance before its window.
What this delivers
Patched Redis on the current BSD terms, with the licence question separated from the CVE question and decided on its own merits. A supported destination either way: Redis 7.2, a newer Redis release or Valkey. OSSeva for Redis is priced per instance cluster, not per GB of memory or per operation; book a discovery call for a quote.
Does the Redis licence change affect versions we already run?
No. Code released under BSD stays BSD. The RSALv2 and SSPLv1 dual licence applies to versions released after the March 2024 change, so Redis 7.2 and earlier remain BSD-3-Clause.
When do Redis 6.2 and 7.0 reach end of life?
Redis 7.0 reached end of life on 29 July 2024, with 7.0.15 as its final release. Redis Open Source 6.2 reaches end of life on 1 April 2027.
Do we need to move to Valkey because of the licence?
Only if the licence affects you. RSALv2 and SSPLv1 restrict offering Redis as a commercial managed service to third parties, and internal enterprise use is unaffected. Valkey is the right choice when you do offer it as a service, or when BSD licensing is a requirement.
Does OSSeva support Valkey?
Yes. OSSeva supports Valkey 7.2.x and 8.x alongside Redis 6.2.x, 7.0.x and 7.2.x, under one contract.
What usually goes wrong in a Redis upgrade?
Rarely the version change. Failures cluster around RDB and AOF persistence under memory pressure, especially fork-based persistence on instances sized close to the host's memory limit.