CVE-2026-25588

Published May 5, 2026

Last updated 3 months ago

CVSS high 7.7
Database

Overview

Description
RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisTimeSeries module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This has been patched in version 1.12.14.
Source
security-advisories@github.com
NVD status
Undergoing Analysis

Risk scores

CVSS 4.0

Type
Secondary
Base score
7.7
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
HIGH

Weaknesses

security-advisories@github.com
CWE-122

Social media

Hype score
Not currently trending

  1. 5 CVEs in Redis https://t.co/32ZcxyrYW5 CVE‑2026‑23479: Use-After-Free in unblock client flow may lead to Remote Code Execution CVE‑2026‑25243,CVE-2026-25588,CVE‑2026‑25589: Invalid Memory Access in RESTORE Command [...] May Lead to RCE CVE-2026-23631: Lua UAF may lea

    @oss_security

    7 Jun 2026

    1262 Impressions

    4 Retweets

    7 Likes

    4 Bookmarks

    1 Reply

    0 Quotes

  2. ⚠️ Vulnerabilidades en productos Redis ❗ CVE-2026-25589 ❗ CVE-2026-25588 ❗ CVE-2026-23479 ➡️ Más info: https://t.co/3dKb2iYiAZ https://t.co/YT4eMlEYZW

    @CERTpy

    20 May 2026

    94 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0.•CVE-2026-54313
  2. PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the import_database_rules() or import_roles_rules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions•CVE-2026-11945
  3. Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability•CVE-2026-35273
  4. Splunk Enterprise Missing Authentication for Critical Function Vulnerability•CVE-2026-20253
  5. Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. While the vulnerability is in Net Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Net Service. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).•CVE-2026-46833

References

Sources include official advisories and independent security research.