What’s Vulnerable › Vulnerabilities

CVE-2025-67733: Valkey Affected by RESP Protocol Injection via Lua error_reply

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-23 · updated 2026-07-15
• Weakness: CWE-74

Description

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

Affected products

• valkey-io valkey: before 7.2.12; from 8.0.0 before 8.0.7; from 8.1.0 before 8.1.6; from 9.0.0 before 9.0.2 — fixed in 7.2.12, 8.0.7, 8.1.6, 9.0.2

How to fix

Upgrade to a fixed version: valkey-io valkey 7.2.12, 8.0.7, 8.1.6, 9.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m
• https://access.redhat.com/errata/RHSA-2026:3443
• https://access.redhat.com/errata/RHSA-2026:3507
• https://access.redhat.com/errata/RHSA-2026:5445
• https://access.redhat.com/security/cve/CVE-2025-67733
• https://bugzilla.redhat.com/show_bug.cgi?id=2442025
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67733.json

Get alerted when CVE-2025-67733 or the next vulnerability affects your stack