Valkey Affected by RESP Protocol Injection via Lua error_reply (CVE-2025-67733)
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
AI Analysis
Technical Summary
Valkey versions prior to 9.0.2, 8.1.6, 8.0.7, and 7.2.12 contain a vulnerability due to improper neutralization of special elements (null characters) in output used by downstream components, specifically in the Lua scripting error handling code. This flaw allows an attacker with scripting command access to inject arbitrary data into the response stream, potentially corrupting or tampering with data returned to other users sharing the same connection. The vulnerability is tracked as CWE-74 (Improper Neutralization of Special Elements) and CWE-170 (Improper Null Termination). Red Hat has issued security advisories and patches addressing this issue. The CVSS v3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, scope changed, no confidentiality impact, integrity impact, and high availability impact.
Potential Impact
An attacker with scripting command access can inject arbitrary information into the response stream, potentially causing data tampering or denial of service for other users on the same connection. This compromises data integrity and availability but does not affect confidentiality according to the CVSS vector. The vulnerability can disrupt normal operations and corrupt data returned to clients.
Mitigation Recommendations
Official fixes are available in valkey versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12. Users should upgrade to these or later versions to remediate the vulnerability. Refer to the Red Hat advisories RHSA-2026:3507 and RHSA-2026:5445 for detailed patching instructions. No additional mitigation is required beyond applying the official patches.
Valkey Affected by RESP Protocol Injection via Lua error_reply (CVE-2025-67733)
Description
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Valkey versions prior to 9.0.2, 8.1.6, 8.0.7, and 7.2.12 contain a vulnerability due to improper neutralization of special elements (null characters) in output used by downstream components, specifically in the Lua scripting error handling code. This flaw allows an attacker with scripting command access to inject arbitrary data into the response stream, potentially corrupting or tampering with data returned to other users sharing the same connection. The vulnerability is tracked as CWE-74 (Improper Neutralization of Special Elements) and CWE-170 (Improper Null Termination). Red Hat has issued security advisories and patches addressing this issue. The CVSS v3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, scope changed, no confidentiality impact, integrity impact, and high availability impact.
Potential Impact
An attacker with scripting command access can inject arbitrary information into the response stream, potentially causing data tampering or denial of service for other users on the same connection. This compromises data integrity and availability but does not affect confidentiality according to the CVSS vector. The vulnerability can disrupt normal operations and corrupt data returned to clients.
Mitigation Recommendations
Official fixes are available in valkey versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12. Users should upgrade to these or later versions to remediate the vulnerability. Refer to the Red Hat advisories RHSA-2026:3507 and RHSA-2026:5445 for detailed patching instructions. No additional mitigation is required beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:3507
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-21863"]
- State
- PUBLISHED
Threat ID: 6a16097be29bf47b50647ae3
Added to database: 05/26/2026, 20:58:35 UTC
Last enriched: 07/15/2026, 16:15:25 UTC
Last updated: 09/11/2026, 22:06:31 UTC
Views: 107
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.