Redis OSS (< 8.8.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/redis-oss--8.8.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 12:49:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRedisBloom and Redis OSS: Count-Min Sketch RDB deserialization integer overflow (CVE-2026-62356)https://feed.craftedsignal.io/briefs/2026-10-redisbloom-overflow/Thu, 22 Oct 2026 12:49:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-redisbloom-overflow/An integer-overflow vulnerability in RedisBloom CMSketch RDB deserialization allows an authenticated attacker to trigger out-of-bounds memory access, resulting in potential remote code execution or denial of service.RedisBloom is vulnerable to an integer-overflow issue (CVE-2026-62356) within its Count-Min Sketch (CMSketch) RDB deserialization process. By providing a crafted CMSketch object through the RESTORE command or malicious RDB file ingestion, an authenticated attacker can cause the server to allocate an undersized heap buffer. Subsequent interaction with the sketch via commands such as CMS.QUERY, CMS.INCRBY, or CMS.INFO triggers out-of-bounds memory access. This behavior causes a crash (denial of service) or potential remote code execution. A non-weaponized proof-of-concept demonstrating the denial-of-service condition is publicly available.

Attack Chain

  1. Attacker authenticates to the Redis instance.
  2. Attacker crafts a malicious CMSketch object with dimensions designed to induce integer overflow in the length computation.
  3. Attacker sends the payload to the target via RESTORE or triggers ingestion of a compromised RDB file.
  4. The server's CMSRdbLoad routine performs a 64-bit length calculation that wraps around, resulting in the allocation of an undersized heap buffer.
  5. The server commits the poisoned CMSketch object to memory.
  6. Attacker invokes CMS commands (CMS.QUERY, CMS.INCRBY, CMS.INFO) on the object.
  7. The server calculates an index based on the corrupted object dimensions and performs an out-of-bounds access on the undersized heap buffer, leading to SIGSEGV/crash or potential arbitrary code execution.

Impact

Successful exploitation allows for persistent denial-of-service (the corrupted object remains in memory across restarts if persisted to RDB) and provides a primitive for potential remote code execution in the context of the Redis server process.

Recommendation

  1. Patch immediately by upgrading to Redis OSS 8.8.2 or later, and RedisBloom 2.8.24 or later.
  2. If an immediate upgrade is not feasible, restrict access to RESTORE, MIGRATE, DEBUG, and RDB ingestion commands via Redis ACLs to trusted users only.
  3. Treat all serialized data import pathways, including replication, RDB preloading, and backup restoration, as high-risk vectors.
]]>highadvisoryredisinteger-overflowrcedos