CVE-2025-67733

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-67733
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67733.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-67733
Aliases
Downstream
Related
Published
2026-02-23T19:39:29.136Z
Modified
2026-03-06T09:59:22.150321Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H CVSS Calculator
Summary
Valkey Affected by RESP Protocol Injection via Lua error_reply
Details

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67733.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-74"
    ]
}
References

Affected packages

Git / github.com/valkey-io/valkey

Affected ranges

Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7b696d1a4f8b2a5b5393dba7c6706f7aa8599013
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.2.12"
        }
    ]
}
Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
2b5c7a0dbd61fd4281ef6166b7d119ba7fe7368c
Fixed
d77c7aaf01d273d2480aeabf5ed578aa0133d9a1
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
67c8683792fc9ab7e295f833478eca180c5e4691
Fixed
19b07dfcbb75b14a1ed1b0a48cb8a0efcc81d563
Database specific 
{
    "versions": [
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.1.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/valkey-io/valkey
Events
Introduced
5018b12b0de2d2322a1bbf6b041c43740587c0f2
Fixed
1ac4cfe4c877a6cb8cb2e28fa7094055ac06f64b
Database specific 
{
    "versions": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.2"
        }
    ]
}

Affected versions

7.*
7.2.10
7.2.11
7.2.4
7.2.4-rc1
7.2.5
7.2.5-rc1
7.2.6
7.2.7
7.2.8
7.2.9
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.1.1
8.1.2
8.1.3
8.1.4
8.1.5
9.*
9.0.0
9.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67733.json"