Is CVE-2025-67733 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-67733 being exploited in the wild.

How severe is CVE-2025-67733?

High severity, with a CVSS score of 8.5, published 23 February 2026.

Which products and versions are affected?

Red Hat Enterprise Linux AppStream 9, 10, 10.0 EUS.

Is there a fix for CVE-2025-67733?

A patch was published on 2026-02-23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-67733 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-67733?

Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67733: Valkey RESP protocol injection in Lua error_reply

CVE-2025-67733 · Severity: high · CVSS 8.5 · Published 2026-02-23

Valkey is a high-performance database used for storing and managing data in memory. A security flaw allows a user with basic access to use database scripts to inject fake information into the data stream. This could lead to data being corrupted or tampered with, and could potentially cause service disruptions for other users sharing the same connection.

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Quick answers

Is CVE-2025-67733 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-67733 being exploited in the wild.
How severe is CVE-2025-67733?: High severity, with a CVSS score of 8.5, published 23 February 2026.
Which products and versions are affected?: Red Hat Enterprise Linux AppStream 9, 10, 10.0 EUS.
Is there a fix for CVE-2025-67733?: A patch was published on 2026-02-23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67733 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-67733?: Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A protocol injection vulnerability exists in Valkey's Lua scripting engine due to improper handling of null characters within error handling code. An authenticated attacker with permissions to execute Lua scripts can use the 'error_reply' function to inject arbitrary RESP (Redis Serialization Protocol) sequences into the client's response stream. This can result in response splitting, where a single request generates multiple responses, potentially leading to data tampering or cache poisoning for other users on the same connection. The vulnerability is caused by the improper neutralization of special elements (CWE-74) and improper null termination (CWE-170). Patches are available in versions 7.2.12, 8.0.7, 8.1.6, and 9.0.2.

Affected products

Valkey-io Valkey < 7.2.12, >= 8.0.0 < 8.0.7, >= 8.1.0 < 8.1.6, >= 9.0.0 < 9.0.2
Red Hat Enterprise Linux AppStream 9, 10, 10.0 EUS

Timeline

2026-02-23: disclosed
2026-02-23: advisory: GitHub Advisory GHSA-p876-p7q5-hv2m published
2026-02-23: patched
2026-02-26: advisory: Red Hat security advisory RHSA-2026:3443 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.