CVE-2025-67733highCWE-170CWE-74

CVE-2025-67733: high-severity vulnerability in valkey-io valkey

Valkey Affected by RESP Protocol Injection via Lua error_reply

Published · Updated

Follow this CVE+ Monitor valkey+ Monitor redis

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.6%
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Affected products
valkey-io · valkey
Related CVEs — valkey-io valkey

In the same product, most dangerous first.

CVE-2026-63639HIGHValkey: UAF in stream deserialization may lead to remote code executionEPSS 0.9%CVE-2026-85522MEDIUMvalkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-boundsEPSS 0.9%CVE-2026-21863HIGHMalformed Valkey Cluster bus message can lead to Remote DoSEPSS 0.8%CVE-2026-86227LOWvalkey-io valkey kvstore.c kvstoreGetHashtable out-of-boundsEPSS 0.5%CVE-2026-56684HIGHValkey: TLS pending-data processing use-after-free may allow remote code executionEPSS 0.5%CVE-2026-27623HIGHValkey has Pre-Authentication DOS from malformed RESP requestEPSS 0.4%