v8.8.1 missing two security fixes present in master - please consider backport #15615

Two security fixes that are present in master (8f36533, 2026-08-08) are NOT in the latest stable release v8.8.1 (2026-07-23):

1. a8edcfc (2026-08-06): "Fix use-after-free in handleClientsBlockedOnKey"

• Affects BLPOP / BRPOP / LMPOP / BLMOVE blocking commands
• Memory corruption under specific race conditions during key expiry/deletion
• Risk: UAF can be triggered by clients using blocking commands

2. c0a8326 (2026-06-02): "Fix integer overflow in cluster bus PUBLISH and MODULE message length validation"

• Cluster mode only
• Message length field overflow -> OOB read/write
• Risk: Cluster nodes can be attacked via crafted cluster bus messages

Both fixes are in master. v8.8.1 deployments are vulnerable to both issues until backported or until the next release includes these commits.

Workaround

• For a8edcfc: avoid BL* blocking commands where possible; use non-blocking variants (LPOP/RPOP); monitor for crashes
• For c0a8326: cluster mode users should consider monitoring + un trusted nodes restriction

Suggested next steps

• Backport these two commits to v8.8.x LTS branch
• Or release v8.8.2 / v8.9.x with these fixes included
• Reference the fix SHAs in release notes so operators can correlate

Discovered during a security review of master on 2026-08-10.