Junglewise Threat Intelligence

CVE-2025-67733: Valkey RESP protocol injection in Lua error_reply

CVE-2025-67733 · Severity: high · CVSS 8.5 · Published 2026-02-23

Technologies: Red Hat Enterprise Linux AppStream, Valkey-io Valkey. Vendors: Red Hat.

Executive brief

Valkey is a high-performance database used for storing and managing data in memory. A security flaw allows a user with basic access to use database scripts to inject fake information into the data stream. This could lead to data being corrupted or tampered with, and could potentially cause service disruptions for other users sharing the same connection.

Technical details

A protocol injection vulnerability exists in Valkey's Lua scripting engine due to improper handling of null characters within error handling code. An authenticated attacker with permissions to execute Lua scripts can use the 'error_reply' function to inject arbitrary RESP (Redis Serialization Protocol) sequences into the client's response stream. This can result in response splitting, where a single request generates multiple responses, potentially leading to data tampering or cache poisoning for other users on the same connection. The vulnerability is caused by the improper neutralization of special elements (CWE-74) and improper null termination (CWE-170). Patches are available in versions 7.2.12, 8.0.7, 8.1.6, and 9.0.2.

Affected products

  • Valkey-io Valkey < 7.2.12, >= 8.0.0 < 8.0.7, >= 8.1.0 < 8.1.6, >= 9.0.0 < 9.0.2
  • Red Hat Enterprise Linux AppStream 9, 10, 10.0 EUS

Timeline

  • 2026-02-23: disclosed
  • 2026-02-23: advisory: GitHub Advisory GHSA-p876-p7q5-hv2m published
  • 2026-02-23: patched
  • 2026-02-26: advisory: Red Hat security advisory RHSA-2026:3443 published

References

Related threats