CVE-2025-67733

Valkey Affected by RESP Protocol Injection via Lua error_reply

HIGH

7.1

CVSS Score

Published: February 23, 2026 at 07:39 PM UTC

Updated: July 15, 2026 at 02:17 AM UTC

2 products affected across 2 vendorsValkeyValkey

Using valkey by valkey-io?

Get instant alerts when new vulnerabilities affect valkey - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.1

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Valkey · Lfprojects

95%

v < 7.2.128.0.0 ≤ v < 8.0.78.1.0 ≤ v < 8.1.69.0.0 ≤ v < 9.0.2

Affected range stops below 7.2.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.0.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.1.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.0.2, so it looks safe — our inference, not a vendor statement

Valkey · Valkey Io

60%

v < 7.2.12v < 8.0.7v < 8.1.6v < 9.0.2

Affected range stops below 7.2.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.0.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.1.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.0.2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m