Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20121-1 advisory.

    - Updated to 8.2.3 (boo#1252996 CVE-2025-62507)
      * https://github.com/redis/redis/releases/tag/8.2.3
      - Security fixes
        - (CVE-2025-62507) Bug in `XACKDEL` may lead to stack overflow           and potential RCE
      - Bug fixes
        - `HGETEX`: A missing `numfields` argument when `FIELDS` is           used can lead to Redis crash
        - An overflow in `HyperLogLog` with 2GB+ entries may result in           a Redis crash
        - Cuckoo filter - Division by zero in Cuckoo filter insertion
        - Cuckoo filter - Counter overflow
        - Bloom filter - Arbitrary memory read/write with invalid           filter
        - Bloom filter - Out-of-bounds access with empty chain
        - Top-k - Out-of-bounds access
        - Bloom filter - Restore invalid filter [We thank AWS security           for responsibly disclosing the security bug]

    - Updated to 8.2.2 (boo#1250995)
      * https://github.com/redis/redis/releases/tag/8.2.2
      * Fixed Lua script may lead to remote code execution (CVE-2025-49844).
      * Fixed Lua script may lead to integer overflow (CVE-2025-46817).
      * Fixed Lua script can be executed in the context of another user         (CVE-2025-46818).
      * Fixed LUA out-of-bound read (CVE-2025-46819).
      * Fixed potential crash on Lua script or streams and HFE defrag.
      * Fixed potential crash when using ACL rules.
      * Added VSIM: new EPSILON argument to specify maximum distance.
      * Added SVS-VAMANA: allow use of BUILD_INTEL_SVS_OPT flag.
      * Added RESP3 serialization performance.
      * Added INFO SEARCH: new SVS-VAMANA metrics.

    - Updated to 8.2.1
      * https://github.com/redis/redis/releases/tag/8.2.1
      - Bug fixes
        * #14240 INFO KEYSIZES - potential incorrect histogram updates           on cluster mode with modules
        * #14274 Disable Active Defrag during flushing replica
        * #14276 XADD or XTRIM can crash the server after loading RDB
        * #Q6601 Potential crash when running FLUSHDB (MOD-10681)
      * Performance and resource utilization
        * Query Engine - LeanVec and LVQ proprietary Intel           optimizations were removed from Redis Open Source
        * #Q6621 Fix regression in INFO (MOD-10779)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can     run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead     to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching     the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using     ACL to restrict XACKDEL command. (CVE-2025-62507)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5523394e-b889-11f0-9446-f02f7497ecda advisory.

    Google Big Sleep reports:
    A user can run the XACKDEL command with multiple ID's and           trigger a stack buffer overflow, which may potentially lead to           remote code execution.
          The problem exists in Redis 8.2 or newer.
          The code doesn't handle the case where the number of ID's exceeds           the STREAMID_STATIC_VECTOR_LEN, and skips a reallocation, which           leads to a stack buffer overflow.
          An additional workaround to mitigate the problem without patching           the redis-server executable is to prevent users from executing           XACKDEL operation. This can be done using ACL to restrict XACKDEL           command.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277013	openSUSE 16 Security Update : redis (openSUSE-SU-2025:20121-1)	Nessus	SuSE Local Security Checks	high
274351	Linux Distros Unpatched Vulnerability : CVE-2025-62507	Nessus	Misc.	high
272256	FreeBSD : redis -- Bug in XACKDEL may lead to stack overflow and potential RCE (5523394e-b889-11f0-9446-f02f7497ecda)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2025-62507

high

Tenable Plugins

high

high

critical