Likely permanent: GitHub doesn’t review this ecosystem
GHSA-q5p6-hwxh-c23h
RedisBloom on redis · published in redisbloom/redisbloom
Facts
- Severity
- High · CVSS score 7.5CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Affected versions (RedisBloom)
- >= 2.0.0, <= 2.8.23As entered by the maintainer. Not reviewed.
- Fixed in (RedisBloom)
- 2.8.24, 2.6.32, 2.4.27
- Affected versions (Redis OSS)
- >= 8.0.0, <= 8.0.8As entered by the maintainer. Not reviewed.
- Fixed in (Redis OSS)
- not stated
- Affected versions (Redis OSS)
- >= 8.2.0, <= 8.2.15As entered by the maintainer. Not reviewed.
- Fixed in (Redis OSS)
- 8.2.9
- Affected versions (Redis OSS)
- >= 8.4.0, <= 8.4.8As entered by the maintainer. Not reviewed.
- Fixed in (Redis OSS)
- 8.4.6
- Affected versions (Redis OSS)
- >= 8.6.0, <= 8.6.5As entered by the maintainer. Not reviewed.
- Fixed in (Redis OSS)
- 8.6.6
- Affected versions (Redis OSS)
- >= 8.8.0, <= 8.8.1As entered by the maintainer. Not reviewed.
- Fixed in (Redis OSS)
- 8.8.2
- Affected versions (Redis OSS)
- = 8.10.0As entered by the maintainer. Not reviewed.
- Fixed in (Redis OSS)
- 8.10.1
- Affected versions (Redis Software)
- >= 7.2.4-52, <= 7.2.4-153As entered by the maintainer. Not reviewed.
- Fixed in (Redis Software)
- 7.2.4-154
- Affected versions (Redis Software)
- >= 7.4.2-54, <= 7.4.6-279As entered by the maintainer. Not reviewed.
- Fixed in (Redis Software)
- 7.4.6-280
- Affected versions (Redis Software)
- >= 7.8.2-34, <= 7.8.6-260As entered by the maintainer. Not reviewed.
- Fixed in (Redis Software)
- 7.8.6-263
- Affected versions (Redis Software)
- >= 7.22.0-95, <= 7.22.2-116As entered by the maintainer. Not reviewed.
- Fixed in (Redis Software)
- 7.22.2-133
- Affected versions (Redis Software)
- >= 8.0.2-17, <= 8.0.18-36As entered by the maintainer. Not reviewed.
- Fixed in (Redis Software)
- 8.0.20-19
- CVE
- CVE-2026-62356 · reserved, record not publishedThe ID is public but empty: looking it up returns nothing. The CVE Program expects publication within 72 hours.
- GitHub Advisory Database
- Not reviewed
- OSV.dev
- Not present
- Other CVEs pointing here
- None found in the CVE List
If you use RedisBloom >= 2.0.0, <= 2.8.23
Upgrade to the fixed version for your release line: 2.8.24, 2.6.32, 2.4.27. Dependabot, npm audit and OSV-Scanner probably never will.
Timeline
2026-08-17 17:41 UTC
Published by the maintainers
Cites CVE-2026-62356
2026-10-31 12:46 UTC
First seen by Limbowatch
CVE still reserved · not reviewed · not in OSV
Waiting
CVE record published
Not expected
Reviewed by GitHub
GitHub doesn’t review this ecosystem
Machine-readable record: feed/GHSA-q5p6-hwxh-c23h.json