Vulnerability · Published May 5, 2026 · Assigned by GitHub_M

CVE-2026-25589RedisBloom RESTORE invalid memory access may allow remote code execution

High 7.7

In plain English

A high-severity heap buffer overflow in RedisBloom from RedisBloom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)1.7%top 22.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisBloom module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This issue is fixed in version 2.8.20.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:24.04:LTS	redis	no fix listed	UBUNTU-CVE-2026-25589
Ubuntu:25.10	redis	no fix listed	UBUNTU-CVE-2026-25589
Ubuntu:26.04:LTS	redis	no fix listed	UBUNTU-CVE-2026-25589
Ubuntu:26.10	redis	no fix listed	UBUNTU-CVE-2026-25589

Affected products (as reported)

Vendor	Product	Versions
RedisBloom	RedisBloom	< 2.8.20

Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/RedisBloom/RedisBloom/security/advisories/GHSA-7862-34pw-44wv x_refsource_CONFIRM
https://github.com/RedisBloom/RedisBloom/releases/tag/v2.8.20 x_refsource_MISC