RedisBloom is a probabilistic data structures module for Redis

#!/usr/bin/env bash
# check_cve_2026_25589.sh
# Determine likely exposure to CVE-2026-25589 (RedisBloom RESTORE invalid memory access)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

HOST="127.0.0.1"
PORT="6379"
USER=""
PASS=""
TIMEOUT_BIN="timeout"

usage() {
  echo "Usage: $0 [-h host] [-p port] [-u user] [-a password]"
}

while getopts ":h:p:u:a:" opt; do
  case "$opt" in
    h) HOST="$OPTARG" ;;
    p) PORT="$OPTARG" ;;
    u) USER="$OPTARG" ;;
    a) PASS="$OPTARG" ;;
    *) usage; exit 2 ;;
  esac
done

if ! command -v redis-cli >/dev/null 2>&1; then
  echo "UNKNOWN - redis-cli not found"
  exit 2
fi

redis_cmd() {
  local args=( -h "$HOST" -p "$PORT" --raw )
  if [ -n "$USER" ]; then
    args+=( --user "$USER" )
  fi
  if [ -n "$PASS" ]; then
    args+=( -a "$PASS" )
  fi
  if command -v "$TIMEOUT_BIN" >/dev/null 2>&1; then
    "$TIMEOUT_BIN" 5 redis-cli "${args[@]}" "$@" 2>/dev/null
  else
    redis-cli "${args[@]}" "$@" 2>/dev/null
  fi
}

version_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

version_lt() {
  ! version_ge "$1" "$2"
}

normalize_modver() {
  # convert Redis module integer version (e.g. 20819) to semver (2.8.19)
  local n="$1"
  if [[ ! "$n" =~ ^[0-9]+$ ]]; then
    echo ""
    return
  fi
  local major minor patch
  if [ ${#n} -ge 5 ]; then
    major=${n:0:1}
    minor=${n:1:2}
    patch=${n:3}
  elif [ ${#n} -eq 4 ]; then
    major=${n:0:1}
    minor=${n:1:1}
    patch=${n:2}
  else
    echo ""
    return
  fi
  minor=$((10#$minor))
  patch=$((10#$patch))
  echo "${major}.${minor}.${patch}"
}

INFO_OUT="$(redis_cmd INFO server)"
if [ -z "$INFO_OUT" ]; then
  echo "UNKNOWN - unable to query Redis INFO"
  exit 2
fi

REDIS_VER="$(printf '%s
' "$INFO_OUT" | awk -F: '/^redis_version:/ {gsub(/\r/,"",$2); print $2; exit}')"
if [ -z "$REDIS_VER" ]; then
  echo "UNKNOWN - redis_version not found"
  exit 2
fi

MODULE_OUT="$(redis_cmd MODULE LIST)"
WHOAMI="$(redis_cmd ACL WHOAMI)"
ACL_OUT=""
if [ -n "$WHOAMI" ] && [ "$WHOAMI" != "NOPERM" ] && [ "$WHOAMI" != "ERR unknown command 'ACL'" ]; then
  ACL_OUT="$(redis_cmd ACL GETUSER "$WHOAMI")"
fi

RESTORE_BLOCKED="unknown"
if printf '%s' "$ACL_OUT" | grep -Eqi '(^|[[:space:]])-restore([[:space:]]|$)|(^|[[:space:]])-@dangerous([[:space:]]|$)'; then
  RESTORE_BLOCKED="yes"
elif [ -n "$ACL_OUT" ]; then
  RESTORE_BLOCKED="no"
fi

BF_MODVER_RAW="$(printf '%s
' "$MODULE_OUT" | awk '
  BEGIN{found=0; name=""; ver=""}
  /^name$/ {getline; name=$0}
  /^ver$/ {getline; ver=$0; if (name=="bf" || name=="redisbloom") {print ver; exit}}
')"
BF_MODVER="$(normalize_modver "$BF_MODVER_RAW")"

# Decision tree
# 1) Standalone RedisBloom module loaded -> evaluate module version if possible
# 2) No module loaded and Redis < 8 -> this specific CVE path is not present
# 3) Redis >= 8 may include integrated probabilistic structures -> evaluate OSS branch fixes conservatively

if [ -n "$BF_MODVER_RAW" ]; then
  if [ -z "$BF_MODVER" ]; then
    echo "UNKNOWN - RedisBloom module present but module version could not be normalized (raw=$BF_MODVER_RAW, redis=$REDIS_VER, restore_blocked=$RESTORE_BLOCKED)"
    exit 2
  fi

  VULN="unknown"
  case "$BF_MODVER" in
    2.4.*)
      if version_lt "$BF_MODVER" "2.4.23"; then VULN="yes"; else VULN="no"; fi ;;
    2.6.*)
      if version_lt "$BF_MODVER" "2.6.28"; then VULN="yes"; else VULN="no"; fi ;;
    2.8.*)
      if version_lt "$BF_MODVER" "2.8.20"; then VULN="yes"; else VULN="no"; fi ;;
    *)
      # GHSA says all versions affected; if we see an unrecognized line, stay conservative
      VULN="yes" ;;
  esac

  if [ "$VULN" = "yes" ]; then
    echo "VULNERABLE - RedisBloom module $BF_MODVER on Redis $REDIS_VER (restore_blocked=$RESTORE_BLOCKED)"
    exit 1
  else
    echo "PATCHED - RedisBloom module $BF_MODVER on Redis $REDIS_VER (restore_blocked=$RESTORE_BLOCKED)"
    exit 0
  fi
fi

REDIS_MAJOR="${REDIS_VER%%.*}"
if [[ ! "$REDIS_MAJOR" =~ ^[0-9]+$ ]]; then
  echo "UNKNOWN - could not parse Redis major version from $REDIS_VER"
  exit 2
fi

if [ "$REDIS_MAJOR" -lt 8 ]; then
  echo "PATCHED - no RedisBloom module loaded and Redis version is $REDIS_VER (<8 integrated path not present)"
  exit 0
fi

# Redis 8+ integrated probabilistic structures: compare against published OSS fixed branches.
# Conservative interpretation:
# - 8.2.x fixed at 8.2.6
# - 8.4.x fixed at 8.4.3
# - 8.6.x fixed at 8.6.3
# - 8.8+ assumed patched based on later maintained branch publication
# - 8.0.x/8.1.x/8.3.x/8.5.x treated as vulnerable/unknown-adjacent; keep conservative
case "$REDIS_VER" in
  8.2.*)
    if version_lt "$REDIS_VER" "8.2.6"; then
      echo "VULNERABLE - Redis $REDIS_VER integrated probabilistic path below 8.2.6 (restore_blocked=$RESTORE_BLOCKED)"
      exit 1
    else
      echo "PATCHED - Redis $REDIS_VER >= 8.2.6 (restore_blocked=$RESTORE_BLOCKED)"
      exit 0
    fi ;;
  8.4.*)
    if version_lt "$REDIS_VER" "8.4.3"; then
      echo "VULNERABLE - Redis $REDIS_VER integrated probabilistic path below 8.4.3 (restore_blocked=$RESTORE_BLOCKED)"
      exit 1
    else
      echo "PATCHED - Redis $REDIS_VER >= 8.4.3 (restore_blocked=$RESTORE_BLOCKED)"
      exit 0
    fi ;;
  8.6.*)
    if version_lt "$REDIS_VER" "8.6.3"; then
      echo "VULNERABLE - Redis $REDIS_VER integrated probabilistic path below 8.6.3 (restore_blocked=$RESTORE_BLOCKED)"
      exit 1
    else
      echo "PATCHED - Redis $REDIS_VER >= 8.6.3 (restore_blocked=$RESTORE_BLOCKED)"
      exit 0
    fi ;;
  8.[89].*|9.*)
    echo "PATCHED - Redis $REDIS_VER is on a later branch than the published OSS fixes reviewed (restore_blocked=$RESTORE_BLOCKED)"
    exit 0 ;;
  8.*)
    echo "VULNERABLE - Redis $REDIS_VER is an early/unlisted 8.x branch; compare against vendor-fixed builds manually (restore_blocked=$RESTORE_BLOCKED)"
    exit 1 ;;
  *)
    echo "UNKNOWN - unexpected Redis version format: $REDIS_VER"
    exit 2 ;;
esac