redis-py redis-py ssl support susceptible to MITM attacks

The Fix

pip install redis==7.1.0

Based on closed redis/redis-py issue #1016 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Open PR/Commit

@@ -496,7 +496,7 @@ def __init__(self, host='localhost', port=6379,
                  decode_responses=False, retry_on_timeout=False,
                  ssl=False, ssl_keyfile=None, ssl_certfile=None,
-                 ssl_cert_reqs=None, ssl_ca_certs=None,
+                 ssl_cert_reqs='required', ssl_ca_certs=None,
                  max_connections=None):

fix.md

Option A — Upgrade to fixed release\npip install redis==7.1.0\nWhen NOT to use: Do not use this fix if hostname validation is not required for your application.\n\n

Why This Fix Works in Production

Trigger: redis-py ssl support susceptible to MITM attacks by default
Mechanism: redis-py does not enforce hostname validation for SSL certificates by default
Why the fix works: Enforces ssl_cert_reqs='required' by default to enhance SSL security, addressing issue #1016. (first fixed release: 7.1.0).

Production impact:

If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

redis-py does not enforce hostname validation for SSL certificates by default
Production symptom (often without a traceback): redis-py ssl support susceptible to MITM attacks by default

Proof / Evidence

GitHub issue: #1016
Fix PR: https://github.com/redis/redis-py/pull/1017
First fixed release: 7.1.0
Reproduced locally: No (not executed)
Last verified: 2026-02-09
Confidence: 0.85
Did this fix it?: Yes (upstream fix exists)
Own content ratio: 0.60

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub

“**Issue:** redis-py doesn't enforce hostname validation (Common Name nor Subject Alternative Name) by default when accepting a cert from a remote SSL terminator. This default behavior isn't compatible to accepted PEPs/RFCs and provides a da”

Issue thread · issue description · source

Failure Signature (Search String)

redis-py ssl support susceptible to MITM attacks by default
**Task:** Correct redis-py to validate certificates by default. IMHO this shouldn't be considered a breaking change as it simply reenforces the expected results when initiating a

Copy-friendly signature

signature.txt

Failure Signature
-----------------
redis-py ssl support susceptible to MITM attacks by default
**Task:** Correct redis-py to validate certificates by default. IMHO this shouldn't be considered a breaking change as it simply reenforces the expected results when initiating a SSL connection.

Error Message

Signature-only (no traceback captured)

error.txt

Error Message
-------------
redis-py ssl support susceptible to MITM attacks by default
**Task:** Correct redis-py to validate certificates by default. IMHO this shouldn't be considered a breaking change as it simply reenforces the expected results when initiating a SSL connection.

What Broke

This can lead to potential MITM attacks due to lack of certificate validation.

Why It Broke

redis-py does not enforce hostname validation for SSL certificates by default

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install redis==7.1.0

When NOT to use: Do not use this fix if hostname validation is not required for your application.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/redis/redis-py/pull/1017

First fixed release: 7.1.0

Last verified: 2026-02-09. Validate in your environment.

When NOT to Use This Fix

Do not use this fix if hostname validation is not required for your application.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

Add a TLS smoke test that performs a real handshake in CI (include CA bundle validation and hostname checks).
Alert on handshake failures by error string and endpoint to catch cert/CA changes quickly.

Version Compatibility Table

Version	Status
7.1.0	Fixed

Related Issues

No related fixes found.

Cluster: redis-py:configuration-error redis-py hub redis-py best practices All hubs All clusters

Related clusters: Retry storm Data consistency Race condition

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

redis-py redis-py ssl support susceptible to MITM attacks by default (Fix)