Detections
Analytics
Redis < 7.2.14 / 7.4.x < 7.4.9 / 8.2.x < 8.2.6 / 8.4.x < 8.4.3 / 8.6.x < 8.6.3 / 8.8.x < 8.8-RC1 Multiple Vulnerabilities
high Nessus Plugin ID 372453
Synopsis
A database server running on the remote host is affected by multiple vulnerabilities.Description
The version of Redis installed on the remote host is prior to 7.2.14, or 7.4.x prior to 7.4.9, or 8.2.x prior to 8.2.6, or 8.4.x prior to 8.4.3, or 8.6.x prior to 8.6.3, or 8.8.x prior to 8.8-RC1. It is, therefore, affected by multiple vulnerabilities:- A use-after-free vulnerability exists in unblock client flow due to improper handling of an error return from `processCommandAndResetClient`. An authenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2026-23479)
- A use-after-free vulnerability exists in the master-replica synchronization mechanism. An authenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2026-23631)
- A remote code execution vulnerability exists in the RESTORE command due to improper validation of serialized values. An authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. (CVE-2026-25243, CVE-2026-25588, CVE-2026-25589)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Redis version 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3, 8.8-RC1 or later.See Also
https://raw.githubusercontent.com/redis/redis/7.2/00-RELEASENOTES
https://raw.githubusercontent.com/redis/redis/7.4/00-RELEASENOTES
https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES
https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES
https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES
https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES
Plugin Details
Severity: High
ID: 372453
File Name: redis_8_6_3.nasl
Version: 1.1
Type: Combined
Agent: unix
Family: Misc.
Published: 10/27/2026
Updated: 10/27/2026
Configuration: Enable paranoid mode, Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.9
Percentile: 99.33
CVSS v2
Risk Factor: High
Base Score: 9
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-23479
CVSS v3
Risk Factor: High
Base Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:redis:redis
Required KB Items: Settings/ParanoidReport, installed_sw/Redis Server
Patch Publication Date: 5/5/2026
Vulnerability Publication Date: 5/5/2026
Reference Information
CVE: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243, CVE-2026-25588, CVE-2026-25589