Full-chain RCE exploit for RedisBloom (likely CVE-2026-25589) published.

Full-chain RCE exploit for RedisBloom (likely CVE-2026-25589) published.

Type of vulnerability: Heap Buffer Overflow / Out-of-Bounds Read-Write → Authenticated RCE Affected component: RedisBloom, TDigest structure

The vendor has reportedly published a full remote exploit for a vulnerability in RedisBloom. The attack is based on insufficient validation of serialized TDigest data when loaded via the RESTORE command. A specially crafted object causes an out-of-bounds write to the heap.

The publication includes Python (exploit) and Bash (stand preparation) scripts.

The reported vulnerability corresponds to CVE-2026-25589. Redis disclosed the vulnerability on May 5, 2026, stating that an authenticated user with permission to RESTORE could send a specially crafted payload, causing incorrect memory access and potentially achieving code execution within the Redis process. The vulnerability received a CVSS score of 7.7 according to Redis; NVD also lists a CVSS 3.1 score of 8.8. Patches were released in RedisBloom 2.8.20, 2.6.28, and 2.4.23, as well as in updated Redis OSS/CE branches. As a temporary measure, Redis recommends restricting the RESTORE privilege using ACLs.

RedisBloom provides probabilistic data structures. The affected TDigest structure is used for approximate percentile and quantile calculations in data streams. Starting with Redis 8, probabilistic structures, including TDigest, are included in the standard Redis binary distributions.

Redis is a high-performance data store that primarily operates in memory. It is used as a NoSQL database, cache, session store, message broker, and task queue. Because it works with data in RAM, Redis provides low latency and is often used to accelerate high-traffic websites, APIs, and distributed applications. Redis

Redis is widely used worldwide. According to the Stack Overflow Developer Survey 2025, 30.7% of professional developers worked with Redis in the past year, ranking fifth among the databases listed in the survey.