# CVE-2025-67733: Valkey RESP protocol injection in Lua error_reply

Source: https://junglewise.ai/threats/cve-2025-67733-valkey-resp-protocol-injection-in-lua-error-reply  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-23. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-67733 · Severity: high · CVSS 8.5 · Published 2026-02-23

Valkey is a high-performance database used for storing and managing data in memory. A security flaw allows a user with basic access to use database scripts to inject fake information into the data stream. This could lead to data being corrupted or tampered with, and could potentially cause service disruptions for other users sharing the same connection.

Technologies: [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-67733 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67733 being exploited in the wild.

**How severe is CVE-2025-67733?** High severity, with a CVSS score of 8.5, published 23 February 2026.

**Which products and versions are affected?** Red Hat Enterprise Linux AppStream 9, 10, 10.0 EUS.

**Is there a fix for CVE-2025-67733?** A patch was published on 2026-02-23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-67733 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-67733?** Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A protocol injection vulnerability exists in Valkey's Lua scripting engine due to improper handling of null characters within error handling code. An authenticated attacker with permissions to execute Lua scripts can use the 'error_reply' function to inject arbitrary RESP (Redis Serialization Protocol) sequences into the client's response stream. This can result in response splitting, where a single request generates multiple responses, potentially leading to data tampering or cache poisoning for other users on the same connection. The vulnerability is caused by the improper neutralization of special elements (CWE-74) and improper null termination (CWE-170). Patches are available in versions 7.2.12, 8.0.7, 8.1.6, and 9.0.2.

## Affected products

- Valkey-io Valkey < 7.2.12, >= 8.0.0 < 8.0.7, >= 8.1.0 < 8.1.6, >= 9.0.0 < 9.0.2
- Red Hat Enterprise Linux AppStream 9, 10, 10.0 EUS

## Timeline

- 2026-02-23: disclosed
- 2026-02-23: advisory: GitHub Advisory GHSA-p876-p7q5-hv2m published
- 2026-02-23: patched
- 2026-02-26: advisory: Red Hat security advisory RHSA-2026:3443 published

## References

- [https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m](https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m)
- [https://access.redhat.com/errata/RHSA-2026:3443](https://access.redhat.com/errata/RHSA-2026:3443)
- [https://access.redhat.com/errata/RHSA-2026:3507](https://access.redhat.com/errata/RHSA-2026:3507)
- [https://access.redhat.com/errata/RHSA-2026:5445](https://access.redhat.com/errata/RHSA-2026:5445)
- [https://access.redhat.com/security/cve/CVE-2025-67733](https://access.redhat.com/security/cve/CVE-2025-67733)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2442025](https://bugzilla.redhat.com/show_bug.cgi?id=2442025)
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67733.json](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67733.json)

## Related threats

- [CESNET libyang heap buffer overflow in lyb_read_string](https://junglewise.ai/threats/cve-2026-44673-cesnet-libyang-heap-buffer-overflow-in-lyb-read-string)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)
- [dnsmasq heap out-of-bounds read in DNSSEC validation](https://junglewise.ai/threats/cve-2026-4891-dnsmasq-heap-out-of-bounds-read-in-dnssec-validation)
- [dnsmasq infinite loop in DNSSEC NSEC parsing](https://junglewise.ai/threats/cve-2026-4890-dnsmasq-infinite-loop-in-dnssec-nsec-parsing)
- [PHP DOMNode::C14N() denial of service via circular linked list](https://junglewise.ai/threats/cve-2026-7263-php-domnode-c14n-denial-of-service-via-circular-linked-list)