CVEvulnerability

CVE-2025-67733

7.1 HIGH Published 2026-02-23 Modified 2026-07-15 Official page ↗
Status
Modified
Published
2026-02-23
Last modified
2026-07-15
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-170, CWE-74

Description

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

Affected configurations

• lfprojects valkey (< 7.2.12) • lfprojects valkey (>= 8.0.0 < 8.0.7) • lfprojects valkey (>= 8.1.0 < 8.1.6) • lfprojects valkey (>= 9.0.0 < 9.0.2)

Related

Weakness · CWE (2)

  • CWE-170 Improper Null Termination weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References