CVE-2025-67733

Modified Modified - Updated After Analysis

Lua Script Injection in Valkey Causes Data Tampering Risk

Publication date: 2026-02-23

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-23

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-02-23

EPSS Evaluated

2026-07-05

NVD

CVE-2025-67733

EUVD

EUVD-2025-207626

Affected Vendors & Products

Vendor	Product	Version / Range
lfprojects	valkey	to 7.2.12 (exc)
lfprojects	valkey	From 8.0.0 (inc) to 8.0.7 (exc)
lfprojects	valkey	From 8.1.0 (inc) to 8.1.6 (exc)
lfprojects	valkey	From 9.0.0 (inc) to 9.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-170	The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Attack-Flow Graph

Executive Summary

CVE-2025-67733 is a high-severity vulnerability in the valkey-server package affecting versions up to 9.0.1. It stems from improper handling of null characters in the Lua scripting error handling code, specifically in the error_reply function.

This flaw allows a malicious user to inject arbitrary data into the RESP (Redis Serialization Protocol) response stream for a given client. As a result, data can be corrupted or tampered data can be returned to other users sharing the same connection.

The attack is network-based, has low complexity, requires low privileges, and does not require user interaction.

Impact Analysis

This vulnerability can impact you by allowing a malicious user to inject arbitrary information into the response stream, potentially causing data corruption or returning tampered data to other users on the same connection.

While there is no confidentiality impact, the integrity of the data can be compromised (low integrity impact), and the availability of the service can be severely affected (high availability impact).

Compliance Impact

I don't know

Detection Guidance

There are no specific detection commands or methods provided for identifying this vulnerability on your network or system.

Mitigation Strategies

The primary and recommended mitigation step is to upgrade the valkey-server package to one of the fixed versions: 9.0.2, 8.1.6, 8.0.7, or 7.2.12.

No additional mitigations beyond patching are provided.

Hi! I’m here to help you understand CVE-2025-67733. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70