Memory Access Vulnerability in RedisTimeSeries Module by Redis
CVE-2026-25588

7.7HIGH

Key Information:

Vendor

Redistimeseries

Status
Redistimeseries
Vendor
CVE Published:
5 May 2026

What is CVE-2026-25588?

The RedisTimeSeries module, utilized in Redis applications, contains a flaw in its handling of serialized values via the RESTORE command. This issue allows authenticated attackers, who can execute the RESTORE command, to exploit the vulnerability by submitting crafted serialized payloads. Such actions can trigger invalid memory access, potentially leading to remote code execution on the affected server. Users are advised to implement access restrictions using ACL rules and upgrade to version 1.12.14 or later to mitigate this risk.

Affected Version(s)

RedisTimeSeries < 1.12.14

References

https://github.com/RedisTimeSeries/RedisTimeSeries/securi...
x_refsource_CONFIRM
https://github.com/RedisTimeSeries/RedisTimeSeries/releas...
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.