Valkey Affected by RESP Protocol Injection via Lua error_reply (valkey-io valkey)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.65 % · percentile 51 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
Weaknesses (CWE)
- CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component
- CWE-170 — Improper Null Termination
References
- https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m
- https://access.redhat.com/security/cve/CVE-2025-67733
- https://bugzilla.redhat.com/show_bug.cgi?id=2442025
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67733.json
- https://access.redhat.com/errata/RHSA-2026:5445
- https://access.redhat.com/errata/RHSA-2026:3443
- https://access.redhat.com/errata/RHSA-2026:3507
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H | GitHub_M |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H | redhat-SADP |
| CVSS 3.1 | HIGH 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
European references
- ENISA EUVD · EUVD-2025-207626
- GCVE · GCVE-0-2025-67733
CERT-FR advisories
- CERTFR-2026-AVI-0223 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*< 7.2.12cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.0.7cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.6cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.2
Affected products
| Product | Versions |
|---|---|
| valkey-io · valkey | affected < 7.2.12 ; affected >= 8.0.0, < 8.0.7 ; affected >= 8.1.0, < 8.1.6 ; affected >= 9.0.0, < 9.0.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |