CVE-2025-67733

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:lfprojects:valkey::::::::
	cpe:2.3:a:lfprojects:valkey::::::::
	cpe:2.3:a:lfprojects:valkey::::::::
	cpe:2.3:a:lfprojects:valkey::::::::

History

25 Feb 2026, 17:34

Type	Values Removed	Values Added
Summary		(es) Valkey es una base de datos distribuida de clave-valor. Antes de las versiones 9.0.2, 8.1.6, 8.0.7 y 7.2.12, un usuario malicioso puede usar comandos de scripting para inyectar información arbitraria en el flujo de respuesta para el cliente dado, potencialmente corrompiendo o devolviendo datos manipulados a otros usuarios en la misma conexión. El código de manejo de errores para scripts de lua no maneja correctamente los caracteres nulos. Las versiones 9.0.2, 8.1.6, 8.0.7 y 7.2.12 solucionan el problema.
References	~~() https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m -~~	() https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m - Vendor Advisory
CPE		cpe:2.3:a:lfprojects:valkey::::::::
First Time		Lfprojects valkey Lfprojects

23 Feb 2026, 20:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-23 20:28

Updated : 2026-02-25 17:34

NVD link : CVE-2025-67733

Mitre link : CVE-2025-67733

CVE.ORG link : CVE-2025-67733

JSON object : View

Products Affected

lfprojects

valkey

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2025-67733", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2026-02-23T20:28:53.280", "references": [{"url": "https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue."}, {"lang": "es", "value": "Valkey es una base de datos distribuida de clave-valor. Antes de las versiones 9.0.2, 8.1.6, 8.0.7 y 7.2.12, un usuario malicioso puede usar comandos de scripting para inyectar informaci\u00f3n arbitraria en el flujo de respuesta para el cliente dado, potencialmente corrompiendo o devolviendo datos manipulados a otros usuarios en la misma conexi\u00f3n. El c\u00f3digo de manejo de errores para scripts de lua no maneja correctamente los caracteres nulos. Las versiones 9.0.2, 8.1.6, 8.0.7 y 7.2.12 solucionan el problema."}], "lastModified": "2026-02-25T17:34:02.743", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A7DFDB2-5FDE-4F69-9B9E-7ED6D910EF76", "versionEndExcluding": "7.2.12"}, {"criteria": "cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2375C3CF-6580-4EA0-AA6A-A92198CB7E1F", "versionEndExcluding": "8.0.7", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03050B63-5660-4DFF-B6AC-3E701B9D199D", "versionEndExcluding": "8.1.6", "versionStartIncluding": "8.1.0"}, {"criteria": "cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "315880B4-E0D2-4366-8E7B-2B97D82BA92E", "versionEndExcluding": "9.0.2", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}