CVE-2025-67733
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A vulnerability in Valkey allows a malicious user to inject arbitrary information into the client response stream via Lua scripts. The issue stems from improper handling of null characters in the Lua script error handling code, potentially corrupting or tampering with data for other users on the same connection.
Risk Assessment
The organization faces risks of data integrity breaches and potential man-in-the-middle attacks, where an attacker can manipulate server responses, leading to data theft or privilege escalation.
Recommendation
Immediately upgrade Valkey to versions 9.0.2, 8.1.6, 8.0.7, or 7.2.12 depending on the branch in use. After upgrading, verify the correct operation of Lua scripts and monitor logs for suspicious activity.
Other vulnerabilities in Valkey
See all- CVE-2026-63639High
Use-after-free vulnerability in Valkey prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The RESTORE command accepts a malformed RDB stream that assigns one NACK to multiple consumers, potentially allowing remote code execution.
- CVE-2026-56684High
Valkey, a distributed key-value database, contains a use-after-free vulnerability in the tlsProcessPendingData function. An authenticated client can trigger CLIENT KILL, causing deletion of a node from the list and potentially leading to server crash or remote code execution when TLS is enabled. The issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
- CVE-2026-27623High
A vulnerability in Valkey from version 9.0.0 to 9.0.2 allows an attacker with network access to crash the server by sending a specially crafted request. The issue is caused by improper reset of networking state after processing an empty request, leading to an assertion failure and system abort.
- CVE-2026-21863High
A vulnerability in Valkey allows an attacker with access to the clusterbus port to send a malformed packet, potentially causing an out-of-bounds read and system crash. The issue stems from missing validation of the ping extension packet location within the buffer.
Original NVD description (English source)
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.