CVE-2025-67733: Valkey Affected by RESP Protocol Injection via Lua error_reply
Valkey Affected by RESP Protocol Injection via Lua errorreply
Other sources
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.2.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67733?
The severity of CVE-2025-67733 has not been explicitly defined but poses critical risks due to potential data tampering.
How do I fix CVE-2025-67733?
To fix CVE-2025-67733, upgrade to Valkey versions 9.0.2, 8.1.6, 8.0.7, or 7.2.12 or later.
Who is affected by CVE-2025-67733?
CVE-2025-67733 affects users of Valkey versions prior to 9.0.2, 8.1.6, 8.0.7, and 7.2.12.
What kind of attack does CVE-2025-67733 enable?
CVE-2025-67733 enables a malicious user to inject arbitrary information into the response stream, potentially corrupting data.
What products are impacted by CVE-2025-67733?
The impacted product by CVE-2025-67733 is Valkey, specifically versions prior to 9.0.2, 8.1.6, 8.0.7, and 7.2.12.