Skip to content
Fencer Vulns
high 8.8

CVE-2026-25589 json

RedisBloom RESTORE invalid memory access may allow remote code execution

published 2026-05-05 6 mo ago modified 2026-09-08 2 mo ago also BIT-keydb-2026-25589 , BIT-redis-2026-25589 , EUVD-2026-27414 , GHSA-7862-34pw-44wv

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisBloom module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This issue is fixed in version 2.8.20.

Patch / fix

  • bitnami keydb 8.2.6, 8.4.3, 8.6.3
  • bitnami redis 8.2.6, 8.4.3, 8.6.3
  • redisbloom redisbloom 2.8.20
  • redis redis 8.2.6, 8.4.3, 8.6.3
  • redislabs redis 8.2.6, 8.4.3, 8.6.3
  • redis openSUSE Leap 16.0 8.10.1-bp160.1.1
  • redis-modules openSUSE Leap 16.0 8.10.1-bp160.1.1
  • redis openSUSE Tumbleweed 8.6.3-1.1

opensuse advisories openSUSE-SU-2026:21612-1openSUSE-SU-2026:10711-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-25589 updated cvss 8.8

RedisBloom: RESTORE invalid memory access may allow remote code execution

  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-27/gateway-rhel9
    affected: workaround, no fix available “To mitigate this vulnerability, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.”
  • Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9
    not affected: vulnerable code not present
  • Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9
    not affected: component not present
  • Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9, 3scale-amp2/backend-rhel8 Red Hat AI Inference Server rhaii/vllm-cpu-rhel9, rhaii/vllm-tpu-rhel9, rhaii/vllm-cuda-rhel9, rhaii/vllm-rocm-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, +6 more Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-25/hub-rhel8, ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-27/hub-rhel9, ansible-automation-platform-25/gateway-rhel8, +10 more Red Hat Ceph Storage 9 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 more Red Hat Connectivity Link 1 rhcl-1/limitador-rhel9 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki, rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator
    +4 more products
    Red Hat Discovery 2 discovery/discovery-server-rhel9 Red Hat Enterprise Linux 8 redis Red Hat Enterprise Linux 9 redis Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9, rhelai3/bootc-azure-rocm-rhel9
    not affected: vulnerable code not present
  • Red Hat Hardened Images boost 1.90.0-7.hum1, valkey 9.0.3-1.2.hum1
    not affected: component not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-feature-server-rhel9, rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift Container Platform 4 openshift4/ose-ironic-rhel9, openshift4/ose-ironic-agent-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-ironic-rhel9, openshift5/ose-ironic-agent-rhel9 Red Hat OpenShift Update Service openshift-update-service/openshift-update-service-rhel8 Red Hat OpenStack Platform 18.0 rhoso/openstack-cinder-api-rhel9, rhoso/openstack-cinder-base-rhel9, rhoso/openstack-manila-share-rhel9, rhoso/openstack-nova-compute-rhel9, rhoso/openstack-cinder-backup-rhel9, rhoso/openstack-cinder-volume-rhel9, +1 more Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9
    +3 more products
    Red Hat Satellite 6 python-redis, python3-redis, tfm-pulpcore-python-redis, satellite/iop-puptoo-rhel9, satellite/iop-yuptoo-rhel9, rubygem-gitlab-sidekiq-fetcher, +4 more Red Hat Update Infrastructure 4 for Cloud Providers python-redis Red Hat Update Infrastructure 5 rhui5/rhua-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

1.70% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami keydb
>=8.0.0, <8.2.6
>=8.3.0, <8.4.3
>=8.5.0, <8.6.3
8.2.6
8.4.3
8.6.3
bitnami redis
>=8.0.0, <8.2.6
>=8.3.0, <8.4.3
>=8.5.0, <8.6.3
8.2.6
8.4.3
8.6.3

Affected products

  • RedisBloom RedisBloom

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.