CVE-2026-25588: RedisTimeSeries RESTORE invalid memory access may allow remote code execution
RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisTimeSeries module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This has been patched in version 1.12.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RedisTimeSeriesto a version that resolves this vulnerability.Fixed in 1.12.14 - Compensating control
Restrict access to the Redis RESTORE command using ACL rules so that only trusted principals can execute RESTORE on servers with the RedisTimeSeries module loaded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25588?
CVE-2026-25588 has a high severity rating due to the potential for remote code execution.
How do I fix CVE-2026-25588?
To fix CVE-2026-25588, upgrade RedisTimeSeries to version 1.12.14 or later.
What versions are affected by CVE-2026-25588?
CVE-2026-25588 affects all versions of RedisTimeSeries prior to 1.12.14.
What is the cause of CVE-2026-25588?
CVE-2026-25588 is caused by improper validation of serialized values processed through the Redis RESTORE command.
Who can be affected by CVE-2026-25588?
Any user utilizing RedisTimeSeries versions below 1.12.14 may be affected by CVE-2026-25588.