CVE-2025-67733
Fixed in a distro release EPSS <1%CVSS 8.5
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
Products: valkey-io valkey, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | valkey | 8.0.7-1.el10_1 |
| AlmaLinux 10 | valkey-devel | 8.0.7-1.el10_1 |
| AlmaLinux 9 | valkey | 8.0.7-1.el9_7 |
| AlmaLinux 9 | valkey-devel | 8.0.7-1.el9_7 |
| Alpine 3.21 | valkey | 7.2.12-r0 |
| Alpine 3.22 | valkey | 8.1.6-r0 |
| Alpine 3.23 | valkey | 9.0.3-r0 |
| Alpine 3.24 | valkey | 9.0.3-r0 |
| Debian 12 | redis | 5:7.0.15-1~deb12u7 |
| Debian 13 | redis | 5:8.0.2-3+deb13u2 |
| Debian 13 | valkey | 8.1.1+dfsg1-3+deb13u2 |
| Debian 14 | redict | 7.3.6+ds-2 |
| Debian 14 | redis | 5:8.0.6-1 |
| Debian 14 | valkey | 8.1.4+dfsg1-2 |
| Red Hat Enterprise Linux 10.1 | valkey | 0:8.0.7-1.el10_1 |
| Red Hat Enterprise Linux 10.1 | valkey-debuginfo | 0:8.0.7-1.el10_1 |
| Red Hat Enterprise Linux 10.1 | valkey-debugsource | 0:8.0.7-1.el10_1 |
| Red Hat Enterprise Linux 10.1 | valkey-devel | 0:8.0.7-1.el10_1 |
| Red Hat Enterprise Linux 9 | valkey | 0:8.0.7-1.el9_7 |
| Red Hat Enterprise Linux 9 | valkey-debuginfo | 0:8.0.7-1.el9_7 |
| Red Hat Enterprise Linux 9 | valkey-debugsource | 0:8.0.7-1.el9_7 |
| Red Hat Enterprise Linux 9 | valkey-devel | 0:8.0.7-1.el9_7 |
| Red Hat Enterprise Linux eus 10.0 | valkey | 0:8.0.7-1.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | valkey-debuginfo | 0:8.0.7-1.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | valkey-debugsource | 0:8.0.7-1.el10_0 |
| Red Hat Enterprise Linux eus 10.0 | valkey-devel | 0:8.0.7-1.el10_0 |
| Rocky Linux 10 | valkey | 0:8.0.7-1.el10_1 |
| Rocky Linux 9 | valkey | 0:8.0.7-1.el9_7 |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | valkey | 8.0.7-150700.3.14.1 |
| Ubuntu 24.04 LTS | valkey | 7.2.12+dfsg1-0ubuntu0.1 |
| Ubuntu 25.10 | valkey | 8.1.6+dfsg1-0ubuntu0.1 |
| openSUSE Leap 15.6 | valkey | 8.0.7-150600.13.20.1 |
| openSUSE Tumbleweed | valkey | 9.0.3-1.1 |