Redisbloom
Approved changes feed: RSS · Atom
cpe:2.3:a:redisbloom:redisbloom:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Redisbloom (0e0bd5ae-7f34-51dd-bef3-633bd24b4e41) |
|---|---|
| Product | Redisbloom (6433a7ed-d6e3-5a42-9071-03f9cd1da4ad) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/redisbloom/redisbloom |
purl2cpe | 2026-06-01 10:12:37.293481 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-25589 |
vulnerable | 2026-06-08 07:53:20.056649 |
RedisBloom RESTORE invalid memory access may allow remote code execution
RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisBloom module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This issue is fixed in version 2.8.20.
Published: 2026-05-05T16:50:35.545Z
Updated: 2026-05-05T18:49:30.919Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-55656 |
vulnerable | 2026-06-08 06:54:17.163843 |
RedisBloom Integer Overflow Remote Code Execution Vulnerability
HIGH (8.8)
RedisBloom adds a set of probabilistic data structures to Redis. There is an integer overflow vulnerability in RedisBloom, which is a module used in Redis. The integer overflow vulnerability allows an attacker (a redis client which knows the password) to allocate memory in the heap lesser than the required memory due to wraparound. Then read and write can be performed beyond this allocated memory, leading to info leak and OOB write. The integer overflow is in CMS.INITBYDIM command, which initialize a Count-Min Sketch to dimensions specified by user. It accepts two values (width and depth) and uses them to allocate memory in NewCMSketch(). This vulnerability is fixed in 2.2.19, 2.4.12, 2.6.14, and 2.8.2.
Published: 2025-01-08T15:38:54.859Z
Updated: 2025-01-08T15:52:23.554Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25116 |
vulnerable | 2026-06-08 06:31:22.178684 |
Specially crafted CF.RESERVE command can lead to denial-of-service
MEDIUM (5.5)
RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, authenticated users can use the `CF.RESERVE` command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.
Published: 2024-04-09T17:35:08.800Z
Updated: 2024-08-01T23:36:21.715Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25115 |
vulnerable | 2026-06-08 06:31:22.178169 |
RedisBloom heap buffer overflow in CF.LOADCHUNK command
HIGH (7)
RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted `CF.LOADCHUNK` commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.
Published: 2024-04-09T17:31:48.469Z
Updated: 2024-08-01T23:36:21.630Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.