High severity · published May 5, 2026
CVE-2026-25589
RedisBloom RESTORE invalid memory access may allow remote code execution
8.8
CVSS
1.7%
EPSS
No
On KEV
Description
RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisBloom module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This issue is fixed in version 2.8.20.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
RedisBloom · RedisBloom
< 2.8.20 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25589
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25589
Patch
https://github.com/RedisBloom/RedisBloom/releases/tag/v2.8.20
Mitigation
https://github.com/RedisBloom/RedisBloom/security/advisories/GHSA-7862-34pw-44wv
More from RedisBloom
8.8
CVE-2024-55656
RedisBloom Integer Overflow Remote Code Execution Vulnerability
7.0
CVE-2024-25115
RedisBloom heap buffer overflow in CF.LOADCHUNK command
5.5
CVE-2024-25116
Specially crafted CF.RESERVE command can lead to denial-of-service