Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6022 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6022-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 09, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : valkey     CVE ID         : CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844

    Multiple security issues were discovered in the Lua scripting interface     of Valkey, a persistent key-value database, which could result in the     execution of arbitrary code or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 8.1.1+dfsg1-3+deb13u1.

    We recommend that you upgrade your valkey packages.

    For the detailed security status of valkey please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/valkey

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03499-1 advisory.

    - CVE-2025-49844: Malicious Lua scripts may lead to remote code execution.
      [bsc#1250995]

    - CVE-2025-46817: Malicious Lua scripts may lead to integer overflow and       potential remote code execution. [bsc#1250995]

    - CVE-2025-46818: Malicious Lua scripts can be executed in the context of       another user. [bsc#1250995]

    - CVE-2025-46819: Malicious Lua scripts can trigger out-of-bound reads to       facilitate denial-of-service attacks. [bsc#1250995]

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03500-1 advisory.

    - CVE-2025-49844: Malicious Lua scripts may lead to remote code execution.
      [bsc#1250995]

    - CVE-2025-46817: Malicious Lua scripts may lead to integer overflow and       potential remote code execution. [bsc#1250995]

    - CVE-2025-46818: Malicious Lua scripts can be executed in the context of       another user. [bsc#1250995]

    - CVE-2025-46819: Malicious Lua scripts can trigger out-of-bound reads to       facilitate denial-of-service attacks. [bsc#1250995]

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6020 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6020-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 08, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : redis     CVE ID         : CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844

    Multiple security issues were discovered in the Lua scripting interface     of Redis, a persistent key-value database, which could result in the     execution of arbitrary code or denial of service.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 5:7.0.15-1~deb12u6.

    For the stable distribution (trixie), these problems have been fixed in     version 5:8.0.2-3+deb13u1.

    We recommend that you upgrade your redis packages.

    For the detailed security status of redis please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/redis

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an     authenticated user to use a specially crafted Lua script to manipulate different LUA objects and     potentially run their own code in the context of another user. The problem exists in all versions of Redis     with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without     patching the redis-server executable is to prevent users from executing LUA scripts. This can be done     using ACL to block a script by restricting both the EVAL and FUNCTION command families. (CVE-2025-46818)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0258d37d-a118-11f0-9446-f02f7497ecda advisory.

    redis reports:

                An authenticated user may use a specially crafted Lua script to                 manipulate different LUA objects and potentially run their own code                 in the context of another user                 The problem exists in all versions of Redis with Lua scripting.
                An additional workaround to mitigate the problem without patching                 the redis-server executable is to prevent users from executing Lua                 scripts. This can be done using ACL to block a script by restricting                 both the EVAL and FUNCTION command families.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
269918	Debian dsa-6022 : valkey-sentinel - security update	Nessus	Debian Local Security Checks	critical
269786	SUSE SLES15 / openSUSE 15 Security Update : valkey (SUSE-SU-2025:03499-1)	Nessus	SuSE Local Security Checks	critical
269781	SUSE SLES15 / openSUSE 15 Security Update : redis7 (SUSE-SU-2025:03500-1)	Nessus	SuSE Local Security Checks	critical
269759	Debian dsa-6020 : redis - security update	Nessus	Debian Local Security Checks	critical
269462	Linux Distros Unpatched Vulnerability : CVE-2025-46818	Nessus	Misc.	medium
266601	FreeBSD : redis,valkey -- Running Lua function as a different user (0258d37d-a118-11f0-9446-f02f7497ecda)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2025-46818

medium

Tenable Plugins

critical

critical

critical

critical

medium

medium