CVE-2026-25589: RedisBloom RESTORE invalid memory access may allow remote code execution
RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisBloom module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This issue is fixed in version 2.8.20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.20 - Compensating control
Restrict access to the Redis 'RESTORE' command using ACL rules (so only authorized users can execute RESTORE), especially on servers where the RedisBloom module is loaded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25589?
CVE-2026-25589 has a high severity level due to the potential for remote code execution.
How do I fix CVE-2026-25589?
To mitigate CVE-2026-25589, upgrade RedisBloom to version 2.8.20 or later.
What does CVE-2026-25589 affect?
CVE-2026-25589 affects all versions of RedisBloom prior to 2.8.20.
Can CVE-2026-25589 allow unauthorized access?
Yes, CVE-2026-25589 can potentially allow unauthorized remote code execution if exploited.
Is authentication required to exploit CVE-2026-25589?
Yes, the exploitation of CVE-2026-25589 requires an authenticated user to initiate the RESTORE command.