Skip to content

v7.41.4

Choose a tag to compare

View all tags
@ccmrik ccmrik released this 02 Jun 22:44
· 5 commits to main since this release
v7.41.4
1b833ef

Harden Redis object cache against alloptions corruption causing 4 GB OOM crashes

thesportingbase.com suffered two outages (2026-05-28, 2026-06-03) where unserialize() read a corrupted length prefix from the alloptions blob (LZ4+igbinary fails to round-trip) and tried to allocate 4,295,229,440 bytes, fatalling every FPM worker that read it. v7.39.10 fixed one trigger; this hardens the cache itself.

  • P1 (the real fix): the object-cache drop-in no longer persists the options/site-options groups to Redis. WP core memoises alloptions per request, so the cost is at most one indexed wp_options SELECT per worker. Override with define('WP_REDIS_PERSIST_OPTIONS', true);.
  • P2: get() rejects a non-array options:alloptions/notoptions as a cache miss and rebuilds from DB.
  • P3: auto-flush on serializer/compression drift, detected via a rawCommand sentinel key (covers manual wp-config edits / extension changes).
  • P4: admin UI warns on LZ4+igbinary and documents the skipped groups.

Drop-in @version 7.19.0 → 7.41.4.

Assets 4
Loading