High severity · published Feb 23, 2026
CVE-2025-67733
Valkey Affected by RESP Protocol Injection via Lua error_reply
7.1
CVSS
0.6%
EPSS
No
On KEV
Description
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
valkey · valkey-io
< 7.2.12; >= 8.0.0, < 8.0.7; >= 8.1.0, < 8.1.6; >= 9.0.0, < 9.0.2 · source: vendor, NVD
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67733
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67733
Vendor Advisory
https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:3443
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:3507
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:5445
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-67733
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2442025
More from valkey
8.8
CVE-2026-63639
Valkey: UAF in stream deserialization may lead to remote code execution
7.5
CVE-2026-56684
Valkey: TLS pending-data processing use-after-free may allow remote code execution
7.5
CVE-2026-27623
Valkey has Pre-Authentication DOS from malformed RESP request
7.5
CVE-2026-21863
Malformed Valkey Cluster bus message can lead to Remote DoS
5.3
CVE-2026-85522
valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds