{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/redisbloom--2.8.24/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-62356"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Redis OSS (\u003c 8.8.2)","RedisBloom (\u003c 2.8.24)"],"_cs_severities":["high"],"_cs_tags":["redis","integer-overflow","rce","dos"],"_cs_type":"advisory","_cs_vendors":["Redis"],"content_html":"\u003cp\u003eRedisBloom is vulnerable to an integer-overflow issue (CVE-2026-62356) within its Count-Min Sketch (CMSketch) RDB deserialization process. By providing a crafted CMSketch object through the \u003ccode\u003eRESTORE\u003c/code\u003e command or malicious RDB file ingestion, an authenticated attacker can cause the server to allocate an undersized heap buffer. Subsequent interaction with the sketch via commands such as \u003ccode\u003eCMS.QUERY\u003c/code\u003e, \u003ccode\u003eCMS.INCRBY\u003c/code\u003e, or \u003ccode\u003eCMS.INFO\u003c/code\u003e triggers out-of-bounds memory access. This behavior causes a crash (denial of service) or potential remote code execution. A non-weaponized proof-of-concept demonstrating the denial-of-service condition is publicly available.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Redis instance.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious CMSketch object with dimensions designed to induce integer overflow in the length computation.\u003c/li\u003e\n\u003cli\u003eAttacker sends the payload to the target via \u003ccode\u003eRESTORE\u003c/code\u003e or triggers ingestion of a compromised RDB file.\u003c/li\u003e\n\u003cli\u003eThe server's \u003ccode\u003eCMSRdbLoad\u003c/code\u003e routine performs a 64-bit length calculation that wraps around, resulting in the allocation of an undersized heap buffer.\u003c/li\u003e\n\u003cli\u003eThe server commits the poisoned CMSketch object to memory.\u003c/li\u003e\n\u003cli\u003eAttacker invokes CMS commands (\u003ccode\u003eCMS.QUERY\u003c/code\u003e, \u003ccode\u003eCMS.INCRBY\u003c/code\u003e, \u003ccode\u003eCMS.INFO\u003c/code\u003e) on the object.\u003c/li\u003e\n\u003cli\u003eThe server calculates an index based on the corrupted object dimensions and performs an out-of-bounds access on the undersized heap buffer, leading to SIGSEGV/crash or potential arbitrary code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for persistent denial-of-service (the corrupted object remains in memory across restarts if persisted to RDB) and provides a primitive for potential remote code execution in the context of the Redis server process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately by upgrading to Redis OSS 8.8.2 or later, and RedisBloom 2.8.24 or later.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not feasible, restrict access to \u003ccode\u003eRESTORE\u003c/code\u003e, \u003ccode\u003eMIGRATE\u003c/code\u003e, \u003ccode\u003eDEBUG\u003c/code\u003e, and RDB ingestion commands via Redis ACLs to trusted users only.\u003c/li\u003e\n\u003cli\u003eTreat all serialized data import pathways, including replication, RDB preloading, and backup restoration, as high-risk vectors.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-22T12:49:48Z","date_published":"2026-10-22T12:49:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-redisbloom-overflow/","summary":"An integer-overflow vulnerability in RedisBloom CMSketch RDB deserialization allows an authenticated attacker to trigger out-of-bounds memory access, resulting in potential remote code execution or denial of service.","title":"RedisBloom and Redis OSS: Count-Min Sketch RDB deserialization integer overflow (CVE-2026-62356)","url":"https://feed.craftedsignal.io/briefs/2026-10-redisbloom-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - RedisBloom (\u003c 2.8.24)","version":"https://jsonfeed.org/version/1.1"}