PT-2026-37093 · Redis · Redisbloom

Daniel Firer + 1 · Published 2026-05-05 · Updated 2026-06-03 · CVE-2026-25589

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RedisBloom versions prior to 2.8.20

Description RedisBloom, a probabilistic data structures module for Redis, fails to properly validate serialized values processed via the 'RESTORE' command. An authenticated attacker with permissions to execute 'RESTORE' on a server where the module is loaded can provide a crafted serialized payload to trigger invalid memory access, which may result in remote code execution.

Recommendations Update to version 2.8.20. Restrict access to the 'RESTORE' command using ACL rules as a temporary workaround.

Exploit

Fix

RCE

Heap Based Buffer Overflow

Use After Free

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-20

CWE-122

CWE-416

CWE-787

CWE-190

Related Identifiers

BDU:2026-06444

BDU:2026-06448

BDU:2026-06449

BDU:2026-06450

BDU:2026-06451

BIT-KEYDB-2026-25589

BIT-REDIS-2026-25589

CVE-2026-25589

OPENSUSE-SU-2026:10711-1

Affected Products

Redisbloom

References · 31

• 🔥 https://github.com/mgiay/CVE-2026-25589-25588-25243-23631-23479-REDIS · Exploit
• https://github.com/RedisBloom/RedisBloom/releases/tag/v2.8.20 · Patch
• https://github.com/RedisBloom/RedisBloom/security/advisories/GHSA-7862-34pw-44wv · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06451 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-25589 · Security Note
• https://osv.dev/vulnerability/BIT-redis-2026-25589 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06449 · Security Note
• https://ubuntu.com/security/CVE-2026-25589 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25589 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06450 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10711-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06444 · Security Note
• https://bdu.fstec.ru/vul/2026-06448 · Security Note
• https://osv.dev/vulnerability/BIT-keydb-2026-25589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25589 · Security Note