CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in valkey-io valkey (CVE-2025-67733)
CVE-2025-67733 is a high-severity vulnerability in valkey, a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, improper handling of null characters in Lua script error handling allows a malicious user to inject arbitrary information into the response stream. This can lead to data tampering or denial of service affecting other users on the same connection. The issue is fixed in the specified versions.
AI Analysis
Technical Summary
Valkey versions prior to 9.0.2, 8.1.6, 8.0.7, and 7.2.12 contain a vulnerability due to improper neutralization of special elements (null characters) in output used by downstream components, specifically in the Lua scripting error handling code. This flaw allows an attacker with scripting command access to inject arbitrary data into the response stream, potentially corrupting or tampering with data returned to other users sharing the same connection. The vulnerability is tracked as CWE-74 (Improper Neutralization of Special Elements) and CWE-170 (Improper Null Termination). Red Hat has issued security advisories and patches addressing this issue. The CVSS v3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, scope changed, no confidentiality impact, integrity impact, and high availability impact.
Potential Impact
An attacker with scripting command access can inject arbitrary information into the response stream, potentially causing data tampering or denial of service for other users on the same connection. This compromises data integrity and availability but does not affect confidentiality according to the CVSS vector. The vulnerability can disrupt normal operations and corrupt data returned to clients.
Mitigation Recommendations
Official fixes are available in valkey versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12. Users should upgrade to these or later versions to remediate the vulnerability. Refer to the Red Hat advisories RHSA-2026:3507 and RHSA-2026:5445 for detailed patching instructions. No additional mitigation is required beyond applying the official patches.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in valkey-io valkey (CVE-2025-67733)
Description
CVE-2025-67733 is a high-severity vulnerability in valkey, a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, improper handling of null characters in Lua script error handling allows a malicious user to inject arbitrary information into the response stream. This can lead to data tampering or denial of service affecting other users on the same connection. The issue is fixed in the specified versions.
CVSS v3.1
Score 8.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Valkey versions prior to 9.0.2, 8.1.6, 8.0.7, and 7.2.12 contain a vulnerability due to improper neutralization of special elements (null characters) in output used by downstream components, specifically in the Lua scripting error handling code. This flaw allows an attacker with scripting command access to inject arbitrary data into the response stream, potentially corrupting or tampering with data returned to other users sharing the same connection. The vulnerability is tracked as CWE-74 (Improper Neutralization of Special Elements) and CWE-170 (Improper Null Termination). Red Hat has issued security advisories and patches addressing this issue. The CVSS v3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, scope changed, no confidentiality impact, integrity impact, and high availability impact.
Potential Impact
An attacker with scripting command access can inject arbitrary information into the response stream, potentially causing data tampering or denial of service for other users on the same connection. This compromises data integrity and availability but does not affect confidentiality according to the CVSS vector. The vulnerability can disrupt normal operations and corrupt data returned to clients.
Mitigation Recommendations
Official fixes are available in valkey versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12. Users should upgrade to these or later versions to remediate the vulnerability. Refer to the Red Hat advisories RHSA-2026:3507 and RHSA-2026:5445 for detailed patching instructions. No additional mitigation is required beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:3507
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-21863"]
- Cvss Version
- null
Threat ID: 6a16097be29bf47b50647ae3
Added to database: 05/26/2026, 20:58:35 UTC
Last enriched: 07/15/2026, 16:15:25 UTC
Last updated: 07/31/2026, 19:22:56 UTC
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.