It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1066 advisory.

    Redis and Valkey contain a defect such that a well constructed hyperloglog can corrupt arbitrary memory on     the heap, which could lead to remote code execution. (CVE-2025-32023)

    Redis and Valkey contain a defect such that a well constructed hyperloglog can corrupt arbitrary memory on     the heap, which could lead to remote code execution. (CVE-2025-48367)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-11401 advisory.

    - update to 8.0.4       fixes CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02594-1 advisory.

    - CVE-2025-32023: Fixed an out-of-bounds write when working with HyperLogLog commands that can lead to     remote code execution. (bsc#1246059)
    - CVE-2025-48367: Fixed unauthenticated connection causing repeated IP protocol erros that can lead to     client starvation and DoS. (bsc#1246058)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02680-1 advisory.

    - CVE-2025-32023: Fixed out-of-bounds write when working with HyperLogLog commands can lead to remote code     execution. (bsc#1246059)
    - CVE-2025-48367: Fixed unauthenticated connection causing repeated IP protocol erros can lead to client     starvation and DoS. (bsc#1246058)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006177 advisory.

    Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause     repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This     vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of redis / valkey installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-48367 advisory.

  - Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause     repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This     vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. (CVE-2025-48367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:11401 advisory.

    Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can     contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like     appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection,     union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its     outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can     persist it either by dumping the dataset to disk every once in a while, or by appending each command to a     log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first     synchronization, auto-reconnection on net split and so forth.  Other features include Transactions,     Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave     like a cache.  You can use Valkey from most programming languages also.

    Security Fix(es):

    * redis: Redis Stack Buffer Overflow (CVE-2025-27151)

    * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)

    * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-34895333b5 advisory.

    **Valkey 8.0.4**  -  Released Mon 07 July 2025

    Upgrade urgency SECURITY: This release includes security fixes we recommend you     apply as soon as possible.

    Security fixes

    * **CVE-2025-32023** prevent out-of-bounds write during hyperloglog operations (#2146)
    * **CVE-2025-48367** retry accept on transient errors (#2315)

    Security fixes backported from 8.1.2

    * **CVE-2025-27151** Check length of AOF file name in valkey-check-aof (#2146)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02593-1 advisory.

    - CVE-2025-32023: Fixed an out-of-bounds write when working with HyperLogLog commands that can lead to     remote code execution. (bsc#1246059)
    - CVE-2025-48367: Fixed unauthenticated connection causing repeated IP protocol erros that can lead to     client starvation and DoS. (bsc#1246058)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:12789 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)

    * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0125 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-32023:
    Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5,     7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out     of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely     affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3,     7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-     server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to     restrict HLL commands.

    CVE-2025-48367:
    Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause     repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This     vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0697 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-32023:
    Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5,     7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out     of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely     affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3,     7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-     server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to     restrict HLL commands.

    CVE-2025-48367:
    Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause     repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This     vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:11401 advisory.

    * redis: Redis Stack Buffer Overflow (CVE-2025-27151)

    * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)

    * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10664:01 advisory.

    * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)
      * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause     repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This     vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. (CVE-2025-48367)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the redis package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
241772	Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2025-1066)	Nessus	Amazon Linux Local Security Checks	2025/7/10	2026/1/21	high
242442	Oracle Linux 10 : valkey (ELSA-2025-11401)	Nessus	Oracle Linux Local Security Checks	2025/7/21	2025/7/21	high
243297	SUSE SLES15 Security Update : valkey (SUSE-SU-2025:02594-1)	Nessus	SuSE Local Security Checks	2025/8/2	2025/8/2	high
243528	SUSE SLES15 Security Update : redis (SUSE-SU-2025:02680-1)	Nessus	SuSE Local Security Checks	2025/8/5	2026/1/21	high
302324	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis6 (UTSA-2026-006177)	Nessus	Unity Linux Local Security Checks	2026/3/15	2026/3/15	high
242948	Azure Linux 3.0 Security Update: redis / valkey (CVE-2025-48367)	Nessus	Azure Linux Local Security Checks	2025/7/29	2026/1/21	high
242425	RHEL 10 : valkey (RHSA-2025:11401)	Nessus	Red Hat Local Security Checks	2025/7/21	2025/10/9	critical
242685	Fedora 41 : valkey (2025-34895333b5)	Nessus	Fedora Local Security Checks	2025/7/24	2025/7/24	high
243298	SUSE SLES15 / openSUSE 15 Security Update : valkey (SUSE-SU-2025:02593-1)	Nessus	SuSE Local Security Checks	2025/8/2	2025/8/2	high
243446	RHEL 8 : redis:6 (RHSA-2025:12789)	Nessus	Red Hat Local Security Checks	2025/8/4	2025/8/4	high
243959	Alibaba Cloud Linux 3 : 0125: redis:6 (ALINUX3-SA-2025:0125)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/8/6	2025/8/6	high
253460	TencentOS Server 3: redis:6 (TSSA-2025:0697)	Nessus	Tencent Local Security Checks	2025/8/21	2025/12/4	high
266658	RockyLinux 10 : valkey (RLSA-2025:11401)	Nessus	Rocky Linux Local Security Checks	2025/10/6	2025/10/6	critical
282997	MiracleLinux 8 : redis:6 (AXSA:2025-10664:01)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/20	high
245620	Linux Distros Unpatched Vulnerability : CVE-2025-48367	Nessus	Misc.	2025/8/8	2026/8/6	high
275311	Photon OS 5.0: Redis PHSA-2025-5.0-0676	Nessus	PhotonOS Local Security Checks	2025/11/13	2025/11/13	critical

检测

插件搜索

high

high

high

high

high

high

critical

high

high

high

high

high

critical

high

high

critical