Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - RedisTimeSeries 是 Redis 的时间序列模块。在 RedisTimeSeries 之前 1.12.14 的所有版本中，该模块未正确验证通过 Redis RESTORE 命令处理的序列化值。如果经身份验证的攻击者有权限在加载了 RedisTimeSeries 模块的服务器上执行 RESTORE，则可提供会触发无效内存访问并可能导致远程代码执行的序列化负载。变通方案是通过 ACL 规则限制对 RESTORE 命令的访问。已在版本 1.12.14.（CVE-2026-25588）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

根據其自我報告的版本號碼，遠端主機上執行的 Tenable Security Center 是介於 6.7.0 和 6.8.0 之間。因此，它會受到 TNS-2026-19 公告中所提及的多個弱點影響。

  - Redis 是一個記憶體內資料結構儲存區。在 redis-server 版本 7.2.0 至 8.6.3 中，重新執行封鎖的命令時，解除封鎖用戶端流程不會處理來自「processCommandAndResetClient」的錯誤傳回。如果在此流程期間撤回封鎖的用戶端，則經過驗證的攻擊者可觸發釋放後使用，進而導致遠端程式碼執行。現已在 8.6.3 版本中修補此問題。
    (CVE-2026-23479)

  - Redis 是一個記憶體內資料結構儲存區。在 8.6.3 之前的 redis-server 版本中，RESTORE 命令無法正確驗證序列化值。具有執行 RESTORE 權限的已驗證攻擊者可以提供特製的序列化承載，以觸發無效的記憶體存取，並可能導致遠端程式碼執行。因應措施是使用 ACL 規則來限制對 RESTORE 命令的存取。此問題已在 8.6.3 版中修正。(CVE-2026-25243)

  - RedisTimeSeries 是 Redis 的時間序列模組。在 1.12.14 之前的 RedisTimeSeries 的所有版本中，模組都無法正確驗證透過 Redis RESTORE 命令處理的序列化值。在載入了 RedisTimeSeries 模組的伺服器上，具有執行 RESTORE 權限的已驗證攻擊者可以提供特製的序列化承載，以觸發無效的記憶體存取，並可能導致遠端程式碼執行。因應措施是使用 ACL 規則來限制對 RESTORE 命令的存取。現已在 1.12.14 版本中修補此問題。(CVE-2026-25588)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - RedisTimeSeries 是 Redis 的時間序列模組。在 RedisTimeSeries 之前 1.12.14 的所有版本中，模組都無法正確驗證透過 Redis RESTORE 命令處理的序列化值。具有在載入 RedisTimeSeries 模組的伺服器上執行 RESTORE 權限的已驗證攻擊者可以提供特製的序列化承載，以觸發無效的記憶體存取，並可能導致遠端程式碼執行。因應措施是使用 ACL 規則來限制對 RESTORE 命令的存取。這已在版本 1.12.14中修補。（CVE-2026-25588）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

根据其自我报告的版本，远程主机上运行的 Tenable Security Center 版本介于 6.7.0 到 6.8.0 之间。因此，该软件受到 TNS-2026-19 公告中提及的多个漏洞影响。

  - Redis 是内存内数据结构存储。在 redis-server 7.2.0 至 8.6.3 版本中，取消阻断客户端的流程在重新执行被阻断的命令时，没有处理 processCommandAndResetClient 返回的错误。如果在此流程中被阻断的客户端被驱逐，经过身份验证的攻击者可能触发一个释放后使用漏洞，进而导致远程代码执行。该问题已在 8.6.3 版本中修复。
    (CVE-2026-23479)

  - Redis 是内存内数据结构存储。在 redis-server 8.6.3 及之前的版本中，RESTORE 命令没有正确验证序列化值。拥有执行 RESTORE 权限的经过身份验证的攻击者可以提供精心构建的序列化负载，触发无效内存访问，并可能导致远程代码执行。可通过 ACL 规则限制对 RESTORE 命令的访问作为临时缓解措施。该问题已在 8.6.3 版本中修复。(CVE-2026-25243)

  - RedisTimeSeries 是 Redis 的时间序列模块。在 RedisTimeSeries 1.12.14 之前的所有版本中，该模块对通过 Redis RESTORE 命令处理的序列化值验证不充分。在加载了 RedisTimeSeries 模块的服务器上，拥有执行 RESTORE 权限的经过身份验证的攻击者，可以提供精心构造的序列化负载，触发无效内存访问，并可能导致远程代码执行。可通过 ACL 规则限制对 RESTORE 命令的访问作为临时缓解措施。该问题已在 1.12.14 版本中修复。(CVE-2026-25588)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

自己報告されたバージョンによると、リモートホストで実行されている Tenable Security Center 6.7.0～6.8.0 です。したがって、TNS-2026-19 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - Redis はメモリ内データ構造ストアです。7.2.0 から 8.6.3 までの redis-server では、ブロックされていないクライアントフローは、ブロックされたコマンドを再実行するときに、「processCommandAndResetClient」からのエラーリターンを処理しません。ブロックされたクライアントがこのフロー中に退去させられた場合、認証された攻撃者が use-after-free をトリガーし、リモートコードの実行につながる可能性があります。これには、バージョン 8.6.3でパッチが適用されています。
    (CVE-2026-23479)

  - Redis はメモリ内データ構造ストアです。8.6.3 までのバージョンの redis-server では、RESTORE コマンドはシリアル化された値を適切に検証しません。RESTORE を実行する権限を持つ認証された攻撃者が、細工されたシリアル化ペイロードを供給して、無効なメモリアクセスをトリガーし、リモートでコードを実行する可能性があります。回避策は、ACL ルールで RESTORE コマンドへのアクセスを制限することです。これはバージョン 8.6.3 でパッチが適用されています。(CVE-2026-25243)

  - RedisTimeSeries は、Redis の時系列モジュールです。RedisTimeSeries の 1.12.14 以前のすべてのバージョンで、このモジュールは Redis RESTORE コマンドを通じて処理されたシリアル化された値を適切に検証しません。RedisTimeSeries モジュールが読み込まれているサーバー上で RESTORE を実行する権限を持つ認証された攻撃者が、細工されたシリアル化ペイロードを供給して、無効なメモリアクセスをトリガーし、リモートでコードを実行する可能性があります。回避策は、ACL ルールで RESTORE コマンドへのアクセスを制限することです。これには、バージョン 1.12.14でパッチが適用されています。(CVE-2026-25588)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - RedisTimeSeriesは、Redisの時系列モジュールです。RedisTimeSeriesが 1.12.14 される前のすべてのバージョンで、このモジュールはRedis RESTOREコマンドを通じて処理されたシリアル化された値を適切に検証しません。RedisTimeSeriesモジュールがロードされているサーバーでRESTOREを実行するアクセス許可を持つ認証された攻撃者が、細工されたシリアル化ペイロードを供給して、無効なメモリアクセスをトリガーし、リモートでコードを実行する可能性があります。回避策は、ACL ルールで RESTORE コマンドへのアクセスを制限することです。これはバージョン 1.12.14 でパッチ修正されています。(CVE-2026-25588)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21612-1 advisory.

    Changes in redis:

    - Update to 8.10.1

      Update urgency: SECURITY: There are security fixes in the release.

      - Security fixes
        - (CVE-2026-62356) Miscalculated buffer size in CMSketch RDB           loading may lead to heap OOB write
        - Out-of-bounds access in TopK heap cleanup path (MOD-15410)
        - Use-after-free in the TLS pending-data list when a command           closes another pending connection
        - A malicious RDB payload with an out-of-range SLOT_INFO slot           id causes memory corruption during RDB loading, which may           lead to Remote Code Execution
        - Vector Sets: missing node level validation when loading a           vector set from RDB may lead to out-of-bounds access
        - Vector Sets: use-after-free when VREM mutates the HNSW graph           while background VSIM threads are still running
        - Vector Sets: a negative hnsw_search() return was treated as a           huge unsigned count, reading past the end of the result           arrays
        - TLS client certificate authentication bypass: a Common Name           containing an embedded NUL byte was truncated, allowing a           client to authenticate as another (possibly privileged) ACL           user
        - #15594 Use-after-free in the blocked-client list when           reprocessing a command evicts another client blocked on the           same key

    - Restrict the modules flavour to x86_64 and aarch64 -- RedisBloom and       RedisTimeSeries abort on anything else with only supports 64-bit       architectures (x64, arm64v8), redisjson's vendored redis-module is       64-bit only, and modules/common.mk maps no other architecture at all

    - Update to 8.10.0

      Major changes compared to 8.8
      - Compact hashes - a new hash encoding that reduces memory usage         by storing hash field names just once for keys that share a         schema
      - New command: HIMPORT - high-throughput compact hash bulk         insertion
      - TLS peer certificate-based server-to-server authentication
      - New commands: LMOVEM, BLMOVEM - move multiple elements between         lists
      - New command: SUNIONCARD - get the cardinality of the union of         multiple sets
      - New command: SDIFFCARD - get the cardinality of the difference         between sets
      - New command: BACKUP - node-side implementation for backup and         restore based on multi-part AOF (MP-AOF)
      - XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap         the cumulative reply entries and size
      - New command: FT.ALIASLIST - get all aliases for the index
      - Stemmer support for Malay and Tagalog languages
      - JSONPath extensions
      - New commands: TS.NRANGE, TS.NREVRANGE - Query a range across         multiple time series; group results by timestamp
      - New command: TS.READ - optionally blocking read
      - New command: TS.QUERYLABELS - Get a list of labels and         label-values
      - New command: TS.MRANGE, TS.MREVRANGE - new EXCLUDEEMPTY         argument to exclude series with no reported samples
      - Performance improvements

    - Update to 8.8.1       Security fixes
      - RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in         RedisBloom and TDigest may trigger out-of-bounds writes,         potentially leading to remote code execution

    - Update to 8.8.0
      - New data structure: Array (@antirez)
      - Subkey notification for hash fields - field-level notifications
      - INCREX: a window counter rate limiter combining INCR, INCRBY,         INCRBYFLOAT, bounds, and expiration (@raffertyyu + Redis team)
      - XNACK: a new streams command - allow consumers to explicitly         release pending messages
      - ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator
      - JSON.SET: new FPHA argument to specify the FP type for         homogeneous FP arrays
      - TS.RANGE, TS.REVRANGE, TS.MRANGE, TS.MREVRANGE: multiple         aggregators in a single command
      - FT.HYBRID KNN clause: new argument to request fewer candidates         per shard
      - FT.PROFILE HYBRID: profiling support for FT.HYBRID
      - Performance improvements

    - Updated to 8.6.3 (boo#1264164 boo#1264165 boo#1264166 boo#1264167 boo#1264168)
      - Security fixes
        - (CVE-2026-23479) Use-After-Free in unblock client flow may           lead to Remote Code Execution.
        - (CVE-2026-25243) Invalid memory access in RESTORE may lead to           Remote Code Execution
        - (CVE-2026-23631) Lua Use-After-Free may lead to remote code           execution
        - (CVE-2026-25588) Invalid memory access in RESTORE may lead to           Remote Code Execution (Time Series)
        - (CVE-2026-25589) Invalid memory access in RESTORE may lead to           Remote Code Execution (Probabilistic)
      - Bug fixes
        - SUBSCRIBE, PSUBSCRIBE, SSUBSCRIBE: crash on OOM (RED-167788)
        - CONFIG SET: some settings allow invalid characters           (RED-167787)
        - SCRIPT DEBUG: potential crash on scripts (RED-175507)
        - VADD: crash or buffer overflow on large REDUCE value           (RED-170921)
        - VSET: crash on huge allocations (MOD-12678)
        - Potential crash on disconnections and TLS failures (Time           Series) (MOD-14850)
        - RediSearch/RediSearch#8745 Crash when many keys receive           expirations under heavy TTL activity (MOD-14500)
        - RediSearch/RediSearch#8848 HNSW vector index memory growth           under high-churn workloads until shard restart (MOD-13761)
        - RediSearch/RediSearch#8205, RediSearch/RediSearch#8259           FT.HYBRID VSIM RANGE + FILTER incorrectly returns zero           results (MOD-12370, MOD-13884)
        - RediSearch/RediSearch#9182 FT.PROFILE HYBRID returns an empty           reply (MOD-14778)
        - RediSearch/RediSearch#8129, RediSearch/RediSearch#8140           FT.PROFILE reports an incorrect shard total profile time           (MOD-13735, MOD-13181)
        - RediSearch/RediSearch#9047 FT.PROFILE output is inconsistent           when a profiled value is missing (MOD-10560)
        - RediSearch/RediSearch#8791 FT.EXPLAIN does not lock, causing           a race with concurrent index changes (MOD-14461)
        - RediSearch/RediSearch#8382 Crash when indexing negative zero           (-0.0) (MOD-13904)
        - RediSearch/RediSearch#8590 FILTER returns inconsistent           results with multiple indexes sharing field aliases           (MOD-14063)
        - RediSearch/RediSearch#8660 FILTER behavior depends on           property order in the expression (MOD-14065)
        - RediSearch/RediSearch#8593 Filter expressions are evaluated           for indexes that do not match the document type (MOD-14064)
        - RediSearch/RediSearch#8591 Documents are inconsistently           included or excluded depending on the indexing path taken           (MOD-13948)
        - RediSearch/RediSearch#8589 RENAME notification handler loads           the wrong key, causing stale index entries after a rename           (MOD-14328)
        - RediSearch/RediSearch#9012 PERSIST and HPERSIST notifications           are not reflected in index expiration tracking (MOD-14800)
        - RediSearch/RediSearch#9079 FT.SPELLCHECK treats PARAMS           placeholders as literal terms instead of resolving them           (MOD-10596)
        - RediSearch/RediSearch#8462 GC out-of-memory on replica shards           leaves the replica in an inconsistent state (MOD-14066)
        - RediSearch/RediSearch#9066 Race condition in FT.HYBRID causes           intermittent failures under concurrent hybrid query load           (MOD-14732)
        - RediSearch/RediSearch#8109, RediSearch/RediSearch#8149           Configuration registration omits module parameters, causing           them to be unexposed or misapplied (RED-171841)
        - RediSearch/RediSearch#9163 Crash on FT.SEARCH when topology           validation fails (for example, some nodes unreachable)           (MOD-14475)
        - RediSearch/RediSearch#8395 FT.SEARCH fails with Query           requires unavailable slots after shard restart or failover           (MOD-13828)
        - RediSearch/RediSearch#8451 FT.INFO-style output no longer           reports zero-index summary data when no indices exist           (MOD-14079)
        - RediSearch/RediSearch#9078 FT.CREATE now rejects schema           definitions with invalid option combinations at creation time           (MOD-14655)
        - RediSearch/RediSearch#8051, RediSearch/RediSearch#8114 Crash           diagnostics now include the IndexSpec of the index the           failing thread was working on (MOD-7574)
      - Metrics
        - RediSearch/RediSearch#8210, RediSearch/RediSearch#8231           FT.PROFILE: added queue time tracking (MOD-13602)

    - Updated to 8.6.2 (boo#1260399)
      * Fixed potential UAF: don't use reply copy avoidance for module strings.
      * Fixed crash during command processing on replicas performing.
        full synchronization.
      * Fixed potential Memory leaks.
      * Fixed potential crash during ACL checks on wrong-arity commands.
      * Fixed HSETEX HGETEX do not validate that FIELDS is specified only once.

    - Updated to 8.6.1 (boo#1258706)
      * Fixed user can manipulate data read by a connection by         injecting \r\n sequences into a Redis error reply.
      * Fixed INFO command may display module information,         and the missing HOTKEYS HELP subcommand has been added.
      * Fixed RDB loading prevented hash table expansion.

    - Updated to 8.6.0

      Major changes compared to 8.4
      - Substantial performance improvements
      - Substantial memory reduction for hashes (hashtable-encoded) and         sorted sets (skiplist-encoded)
      - Streams: XADD idempotency (at-most-once guarantee) with new         IDMPAUTO and IDMP arguments
      - New eviction policies - least recently modified: volatile-lrm         and allkeys-lrm
      - Hot keys detection and reporting; new command: HOTKEYS
      - TLS certificate-based automatic client authentication
      - Time series: support NaN values; new aggregators: COUNTNAN and         COUNTALL

      New Features
      - #14695 Keys memory size histograms
      - #14615 Streams: XADD idempotency (at-most-once guarantee) with         new IDMPAUTO and IDMP arguments
      - #14624 New eviction policies - least recently modified:
        volatile-lrm and allkeys-lrm
      - #14680 Hot keys detection and reporting; new command: HOTKEYS
      - #14610 TLS certificate-based automatic client authentication
      - RedisTimeSeries/RedisTimeSeries#1853 Time series: support NaN         values; new aggregators: COUNTNAN and COUNTALL Security and         privacy fixes
      - #14645 Hide Personally Identifiable Information from ACL log
      - #14659 ACL: Key-pattern bypass in MSETEX
      - RedisTimeSeries/RedisTimeSeries#1837, RedisJSON/RedisJSON#1474         Hide Personally Identifiable Information from server log
      - RedisBloom/RedisBloom#950 Out-of-bounds read when loading an         invalid RDB file (MOD-12802) Bugfixes
      - #14545 ACL: AOF loading fails if ACL rules are changed and         don't allow some commands in MULTI-EXEC
      - #14637 Atomic slot migration: wrong adjacent slot range         behavior
      - #14567 Atomic slot migration: support delay trimming slots         after finishing migrating slots
      - #14623 Streams: XTRIM/XADD with approx mode (~) dont delete         entries for DELREF/ACKED strategies
      - #14552 Streams: Incorrect behavior when using         XDELEX...ACKEDafterXGROUP DESTROY`
      - #14537 SCAN: restore original filter order (revert change         introduced in 8.2)
      - #14581 Rare server hang at shutdown
      - #14597 Panic when cluster node is uninitialized
      - #14583 FLUSHALL ASYNC on a writable replica may block the main         thread for an extended period
      - #14504 Cluster: fix race condition in broadcast configuration
      - #14416 Fixed argument position handling in Redis APIs
      - RedisTimeSeries/RedisTimeSeries#1784,         RedisTimeSeries/RedisTimeSeries#1839,         RedisBloom/RedisBloom#952, RedisJSON/RedisJSON#1477 Atomic slot         migration support
      - RedisBloom/RedisBloom#946 MEMORY USAGE: fix reported value         (MOD-12799)
      - RedisJSON/RedisJSON#1473 Adding escapes to already-escaped         characters (MOD-8137)
      - RedisJSON/RedisJSON#1475 JSON.CLEAR does not error if more than         one path is specified (MOD-13109) Performance and resource         utilization improvements
      - #14608 Reply copy-avoidance path to reduce memory copies for         bulk string replies
      - #14595 Hash: unify field name and value into a single struct
      - #14701 Sorted set: unify score and value into a single struct
      - #14662 Optimize listpack iterator on hash fields
      - #14699 Optimize set commands with expiration
      - #14700 Optimize prefetching
      - #14715 Optimize prefetch sizing logic
      - #14636 Optimize ZRANK
      - #14676 Utilize hardware clock by default on ARM AArch64
      - #14575 Disable RDB compression when diskless replication is         used
      - #14714 Optimize user ACL permission verification
      - #14692 Optimize peak memory metric collection
      - #14739 Avoid allocating and releasing list node in reply copy         avoidance
      - #14713 Reduce per command syscalls by reusing cached time when         hardware monotonic clock is available
      - #14726 Optimize XREADGROUP CLAIM
      - #13962 Vector set: replace manual popcount with
        __builtin_popcountll for binary vector distance (Intel, AMD,         ARM)
      - #14474 Vector set: vectorized the quantized 8-bit vector         distance calculation (Intel, AMD)
      - #14492 Vector set: vectorize binary quantization path for         vectorsets distance calculation (Intel, AMD) Configuration         parameters
      - #14719 cluster-slot-stats-enabled - per-slot resource         consumptions statistics to collect
      - #14695 key-memory-histograms collect memory consumption         histograms per data type Metrics
      - #14695 db0_distrib_lists_sizes, db0_distrib_sets_sizes,         db0_distrib_hashes_sizes, db0_distrib_zsets_sizes
      - #14610 acl_access_denied_tls_cert - failed TLS         certificatebased authentication attempts Modules API
      - #14445
        - RM_CreateKeyMetaClass - define a new key-metadata class
        - RM_ReleaseKeyMetaClass - release a key-metadata class
        - RM_SetKeyMeta - attach or update a metadata value for a key           under a specific metadata-key class
        - RM_GetKeyMeta - get a metadata value for a key under a           specific metadata-key class Configuration parameters
      - #14624 maxmemory-policy: new eviction policies: volatile-lrm,         allkeys-lrm
      - #14615 stream-idmp-duration, stream-idmp-maxsize - defaults for         streams idempotent production
      - #14610 tls-auth-clients-user TLS certificate-based automatic         client authentication
      - #14596 flushdb option for repl-diskless-load: always flush the         entire dataset before diskless load Known bugs and limitations
      - Streams: avoid using XADD with the new IDMP or IDMPAUTO options         when using appendonly yes with aof-use-rdb-preamble no (non         default). This limitation will be removed in the next patch.
      - Redis Query Engine: In case of load rebalancing operations         (such as Atomic Slot Migration) taking place during the         lifetime of a cursor, there is a chance that some results may         be missing.

    - Updated to 8.4.1
      * https://github.com/redis/redis/releases/tag/8.4.1
      * Atomic slot migration: wrong adjacent slot range behavior.
      * Atomic slot migration: support delay trimming slots after         finishing migrating slots.
      * Fixed CLUSTER SLOT-STATS few memory tracking bugs.

    - Updated to 8.4.0
      - Major changes compared to 8.2
        - DIGEST, DELEX; SET extensions - atomic compare-and-set and           compare-and-delete for string keys
        - MSETEX - atomically set multiple string keys and update their           expiration
        - XREADGROUP - new CLAIM option for reading both idle pending           and incoming stream entries
        - CLUSTER MIGRATION - atomic slot migration
        - CLUSTER SLOT-STATS - per-slot usage metrics: key count, CPU           time, and network I/O
        - Redis query engine: FT.HYBRID - hybrid search and fused           scoring
        - Redis query engine: I/O threading with performance boost for           search and query commands (FT.*)
        - I/O threading: substantial throughput increase (e.g. >30% for           caching use cases (10% SET, 90% GET), 4 cores)
        - JSON: substantial memory reduction for homogenous arrays (up           to 91%)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is between 6.7.0 and 6.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-19 advisory.

  - Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client     flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked     command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-     after-free that may lead to remote code execution. This has been patched in version 8.6.3.
    (CVE-2026-23479)

  - Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command     does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE     can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code     execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in     version 8.6.3. (CVE-2026-25243)

  - RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the     module does not properly validate serialized values processed through the Redis RESTORE command. An     authenticated attacker with permission to execute RESTORE on a server with the RedisTimeSeries module     loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote     code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This has been     patched in version 1.12.14. (CVE-2026-25588)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the     module does not properly validate serialized values processed through the Redis RESTORE command. An     authenticated attacker with permission to execute RESTORE on a server with the RedisTimeSeries module     loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote     code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This has been     patched in version 1.12.14. (CVE-2026-25588)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
312611	Linux Distros 未修补的漏洞：CVE-2026-25588	Nessus	Misc.	2026/5/6	2026/8/1	high
328967	Tenable Security Center 多個弱點 (TNS-2026-19)	Nessus	Misc.	2026/7/22	2026/8/5	high
312611	Linux Distros 未修補的弱點：CVE-2026-25588	Nessus	Misc.	2026/5/6	2026/8/1	high
328967	Tenable Security Center 多个漏洞 (TNS-2026-19)	Nessus	Misc.	2026/7/22	2026/8/5	high
328967	Tenable Security Center の複数の脆弱性 (TNS-2026-19)	Nessus	Misc.	2026/7/22	2026/8/5	high
339035	openSUSE 16 セキュリティ更新:redis(openSUSE-SU-2026:21612-1)	Nessus	SuSE Local Security Checks	2026/8/23	2026/8/23	high
312611	Linux Distros のパッチ未適用の脆弱性: CVE-2026-25588	Nessus	Misc.	2026/5/6	2026/8/1	high
339035	openSUSE 16 Security Update : redis (openSUSE-SU-2026:21612-1)	Nessus	SuSE Local Security Checks	2026/8/23	2026/8/23	high
328967	Tenable Security Center Multiple Vulnerabilities (TNS-2026-19)	Nessus	Misc.	2026/7/22	2026/8/5	high
312611	Linux Distros Unpatched Vulnerability : CVE-2026-25588	Nessus	Misc.	2026/5/6	2026/8/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high