PT-2026-37093

CVE-2026-25589

Published

2026-05-05

Updated

2026-10-22

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RedisBloom versions prior to 2.8.20

Description RedisBloom, a probabilistic data structures module for Redis, fails to properly validate serialized values processed via the 'RESTORE' command. An authenticated attacker with permissions to execute 'RESTORE' on a server where the module is loaded can provide a crafted serialized payload to trigger invalid memory access, which may result in remote code execution.

Recommendations Update to version 2.8.20. Restrict access to the 'RESTORE' command using ACL rules as a temporary workaround.

Exploitability

Exploit

Fix

Impacts