8.5

CVE-2025-67733

Valkey Affected by RESP Protocol Injection via Lua error_reply

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lfprojects ≫ Valkey Version < 7.2.12
Lfprojects ≫ Valkey Version >= 8.0.0 < 8.0.7
Lfprojects ≫ Valkey Version >= 8.1.0 < 8.1.6
Lfprojects ≫ Valkey Version >= 9.0.0 < 9.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.436
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
security-advisories@github.com 8.5 3.1 4.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CWE-170 Improper Null Termination

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3443
https://access.redhat.com/errata/RHSA-2026:3507
https://access.redhat.com/errata/RHSA-2026:5445
https://access.redhat.com/security/cve/CVE-2025-67733
https://bugzilla.redhat.com/show_bug.cgi?id=2442025
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67733.json