CVE-2024-25115: RedisBloom heap buffer overflow in CF.LOADCHUNK command

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-09 · updated 2026-06-17
Weakness: CWE-120

Description

RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted `CF.LOADCHUNK` commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.

Affected products

Redisbloom: from 2.0.0 before 2.4.7; from 2.5.0 before 2.6.10 — fixed in 2.4.7, 2.6.10

How to fix

Upgrade to a fixed version: Redisbloom 2.4.7, 2.6.10. Check the vendor advisory for mitigations.

References

https://github.com/RedisBloom/RedisBloom/commit/2f3b38394515fc6c9b130679bcd2435a796a49ad
https://github.com/RedisBloom/RedisBloom/security/advisories/GHSA-w583-p2wh-4vj5
https://github.com/RedisBloom/RedisBloom/commit/2f3b38394515fc6c9b130679bcd2435a796a49ad
https://github.com/RedisBloom/RedisBloom/security/advisories/GHSA-w583-p2wh-4vj5

Get alerted when CVE-2024-25115 or the next vulnerability affects your stack