The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20926 advisory.

    - rebase to 6.2.20 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819
    - rebase to 6.2.19 for CVE-2025-32023 and CVE-2025-48367
    - rebase to 6.2.18 for CVE-2025-21605
    - rebase to 6.2.17 for CVE-2024-46981

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21936 advisory.

    - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819
    - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0931 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-46817:
    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead     to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is     fixed in version 8.2.2.

    CVE-2025-46818:
    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to manipulate different LUA objects and     potentially run their own code in the context of another user. The problem exists in all versions of Redis     with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without     patching the redis-server executable is to prevent users from executing LUA scripts. This can be done     using ACL to block a script by restricting both the EVAL and FUNCTION command families.

    CVE-2025-46819:
    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and     subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue     is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to     prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both     the EVAL and FUNCTION command families.

    CVE-2025-49844:
    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a     use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis     with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the     redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to     restrict EVAL and EVALSHA commands.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20003-1 advisory.

    Update to 8.0.6:

      - Security fixes:

        - CVE-2025-49844: Fixed that a Lua script may lead to remote code execution (bsc#1250995)
        - CVE-2025-46817: Fixed that a Lua script may lead to integer overflow and potential RCE (bsc#1250995)
        - CVE-2025-46818: Fixed that a Lua script can be executed in the context of another user (bsc#1250995)
        - CVE-2025-46819: Fixed LUA out-of-bound read (bsc#1250995)

      - Bug fixes:

        * Fix accounting for dual channel RDB bytes in replication stats (#2614)
        * Fix EVAL to report unknown error when empty error table is provided (#2229)
        * Fix use-after-free when active expiration triggers hashtable to shrink (#2257)
        * Fix MEMORY USAGE to account for embedded keys (#2290)
        * Fix memory leak when shrinking a hashtable without entries (#2288)
        * Prevent potential assertion in active defrag handling large allocations (#2353)
        * Prevent bad memory access when NOTOUCH client gets unblocked (#2347)
        * Converge divergent shard-id persisted in nodes.conf to primary's shard id (#2174)
        * Fix client tracking memory overhead calculation (#2360)
        * Fix RDB load per slot memory pre-allocation when loading from RDB snapshot (#2466)
        * Don't use AVX2 instructions if the CPU doesn't support it (#2571)
        * Fix bug where active defrag may be unable to defrag sparsely filled pages (#2656)

    Changes from 8.0.5:

      https://github.com/valkey-io/valkey/releases/tag/8.0.5

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11005:04 advisory.

    * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)
      * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)
      * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)
      * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146134 advisory.

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a     use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis     with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the     redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to     restrict EVAL and EVALSHA commands.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the redis package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Ubuntu Linux - Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below     allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector,     trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions     of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without     patching the redis-server executable is to prevent users from executing Lua scripts. This can be done     using ACL to restrict EVAL and EVALSHA commands. (CVE-2025-49844)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
277332	Oracle Linux 9 : redis (ELSA-2025-20926)	Nessus	Oracle Linux Local Security Checks	2025/12/3	2025/12/3	critical
277400	Oracle Linux 10 : valkey (ELSA-2025-21936)	Nessus	Oracle Linux Local Security Checks	2025/12/4	2025/12/4	critical
277458	TencentOS Server 3: redis:6 (TSSA-2025:0931)	Nessus	Tencent Local Security Checks	2025/12/4	2025/12/4	critical
282628	openSUSE 16 : Security update of valkey (openSUSE-SU-2026:20003-1)	Nessus	SuSE Local Security Checks	2026/1/13	2026/1/13	critical
282992	MiracleLinux 9 : redis-6.2.20-1.el9_6 (AXSA:2025-11005:04)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/2/16	critical
372546	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: redis (UTSA-2026-146134)	Nessus	Unity Linux Local Security Checks	2026/10/27	2026/10/28	critical
332262	Photon OS 5.0: Redis PHSA-2025-5.0-91-0676	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/11/4	critical
269464	Linux Distros Unpatched Vulnerability : CVE-2025-49844	Nessus	Misc.	2025/10/8	2026/11/5	high

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

high