CVE-2025-67733
High · 8.5CVSS
8.5
EPSS
0.6%
Published
Feb 23, 2026
CISA due date
—
The record
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | valkey | 0 | 8.0.7-150700.3.14.1 |
| openSUSE:Leap 15.6 | valkey | 0 | 8.0.7-150600.13.20.1 |
| openSUSE:Tumbleweed | valkey | 0 | 9.0.3-1.1 |
Related vulnerabilities
- CVE-2026-21863 Valkey is a distributed key-value database. Also affects valkey
- CVE-2025-49844 Redis is an open source, in-memory database that persists on disk. Also affects valkey
- CVE-2026-23631 Redis is an in-memory data structure store. Also affects valkey
- CVE-2026-25243 Redis is an in-memory data structure store. Also affects valkey
- CVE-2026-23479 Redis is an in-memory data structure store. Also affects valkey
- CVE-2026-27623 Valkey is a distributed key-value database. Also affects valkey
- CVE-2024-46981 Redis is an open source, in-memory database that persists on disk. Also affects valkey
- CVE-2024-51741 Redis is an open source, in-memory database that persists on disk. Also affects valkey