Log in Start free

Vulnerability · Published Feb 23, 2026 · Assigned by GitHub_M

CVE-2025-67733Valkey Affected by RESP Protocol Injection via Lua error_reply

High 8.5

In plain English

A high-severity injection in valkey from valkey-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.6%top 48.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10valkey8.0.7-1.el10_1ALSA-2026:3443
AlmaLinux:9valkey8.0.7-1.el9_7ALSA-2026:3507
AlmaLinux:10valkey-devel8.0.7-1.el10_1ALSA-2026:3443
AlmaLinux:9valkey-devel8.0.7-1.el9_7ALSA-2026:3507
Alpine:v3.21valkey7.2.12-r0ALPINE-CVE-2025-67733
Alpine:v3.22valkey8.1.6-r0ALPINE-CVE-2025-67733
Alpine:v3.23valkey9.0.3-r0ALPINE-CVE-2025-67733
Alpine:v3.24valkey9.0.3-r0ALPINE-CVE-2025-67733
Debian:14redict7.3.6+ds-2DEBIAN-CVE-2025-67733
Debian:12redis5:7.0.15-1~deb12u7DEBIAN-CVE-2025-67733
Debian:13redis5:8.0.2-3+deb13u2DEBIAN-CVE-2025-67733
Debian:14redis5:8.0.6-1DEBIAN-CVE-2025-67733
Debian:13valkey8.1.1+dfsg1-3+deb13u2DEBIAN-CVE-2025-67733
Debian:14valkey8.1.4+dfsg1-2DEBIAN-CVE-2025-67733
Rocky Linux:10valkey0:8.0.7-1.el10_1RLSA-2026:3443
Rocky Linux:9valkey0:8.0.7-1.el9_7RLSA-2026:3507
Ubuntu:24.04:LTSvalkey7.2.12+dfsg1-0ubuntu0.1UBUNTU-CVE-2025-67733
Ubuntu:25.10valkey8.1.6+dfsg1-0ubuntu0.1UBUNTU-CVE-2025-67733

Affected products (as reported)

VendorProductVersions
valkey-io valkey < 7.2.12>= 8.0.0, < 8.0.7>= 8.1.0, < 8.1.6>= 9.0.0, < 9.0.2

Weakness: CWE-74, CWE-170 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

References