CVE-2025-67733: 
Redis vulnerability analysis and mitigation

CVE-2025-67733 is a RESP Protocol Injection vulnerability in Valkey, a distributed key-value database, caused by improper null character handling in Lua script error responses. A low-privileged, network-accessible attacker can inject arbitrary data into the response stream, potentially corrupting or tampering with data returned to other users sharing the same connection. Affected versions include all releases prior to 7.2.12, 8.0.0–8.0.6, 8.1.0–8.1.5, and 9.0.0–9.0.1. The vulnerability was disclosed on February 23, 2026, with patches released the same day. The GitHub Security Advisory assigns a CVSS v3.1 score of 8.5 (High) with Scope: Changed, while NVD scores it 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper null termination (CWE-170) in Valkey's Lua script error handling code, which fails to sanitize null characters before writing error responses to the client output buffer — classified also as CWE-74 (Injection). An attacker with low-level database access can craft a Lua error_reply containing embedded null bytes, causing the RESP (Redis Serialization Protocol) response stream to be injected with arbitrary content. Because Valkey may multiplex responses over shared connections, this injected data can be read by other legitimate clients on the same connection, enabling data tampering. A proof-of-concept exploit was published on GitHub by the reporter (JYlab) shortly after disclosure (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a low-privileged attacker to inject arbitrary data into the RESP response stream, corrupting or tampering with data delivered to other users sharing the same database connection. The primary impacts are high availability disruption (denial of service through stream corruption) and low integrity loss (tampered data returned to legitimate clients). Confidentiality is not directly impacted, as the attacker cannot read other users' data — only inject into the stream. The risk is heightened in multi-tenant or shared-connection deployments where multiple clients use the same Valkey connection (GitHub Advisory, Percona Blog).

A public proof-of-concept exploit is available on GitHub (https://github.com/JYlab/CVE-2025-67733), published by the original reporter JYlab on approximately March 2, 2026. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.02% (0.000200), indicating low current exploitation probability. The vulnerability requires only low privileges and no user interaction, making it relatively straightforward to exploit once an attacker has database access (GitHub Advisory, Feedly).

1. Gain low-privileged access: Obtain credentials or access to a Valkey instance with scripting permissions (e.g., via leaked credentials, weak authentication, or a misconfigured public-facing instance).
2. Identify shared connection scenario: Confirm that the target Valkey deployment uses shared connections (e.g., connection pooling in a multi-tenant application), which increases the impact of stream injection.
3. Craft malicious Lua script: Write a Lua script that calls redis.error_reply() or similar error-generating functions with a payload containing embedded null characters (\x00) followed by arbitrary RESP-formatted data.
4. Execute the script: Use the EVAL or EVALSHA command to execute the crafted Lua script on the Valkey server: EVAL "return redis.error_reply('error\x00+OK\r\n')" 0
5. Inject into response stream: The null character causes the error handling code to truncate or misparse the response, injecting the attacker-controlled RESP data into the output buffer for the client connection.
6. Tamper with other clients' responses: In a shared connection pool, the injected data is read by another legitimate client as a valid response, resulting in data corruption or denial of service (GitHub Advisory, PoC).

• Network: Unusual EVAL or EVALSHA commands from unexpected client IPs in Valkey network traffic; RESP stream anomalies such as unexpected +OK or bulk string responses following error responses.
• Logs: Valkey server logs showing repeated Lua script executions (EVAL commands) from low-privileged users, especially with unusual or binary-containing arguments; client-side application errors indicating unexpected or malformed responses from Valkey.
• Process/Behavior: Application-layer errors in clients connected to Valkey reporting deserialization failures or unexpected data types in responses; connection pool clients receiving responses intended for other clients (e.g., mismatched request/response pairs).
• File System: Presence of the public PoC tool or scripts from https://github.com/JYlab/CVE-2025-67733 on attacker-controlled systems or in forensic artifacts.

Upgrade Valkey to one of the patched versions: 7.2.12, 8.0.7, 8.1.6, or 9.0.2, depending on the currently deployed branch. Red Hat Enterprise Linux users should apply errata RHSA-2026:3443 (RHEL 10), RHSA-2026:3507 (RHEL 9), or RHSA-2026:5445 (RHEL 10 EUS). Ubuntu users should apply USN-8106-1. As interim mitigations, restrict Lua scripting capabilities (EVAL/EVALSHA) to trusted users only using ACL rules, and avoid shared connection pools where multiple untrusted users share a single Valkey connection. No vendor-provided configuration workaround is available beyond patching (GitHub Advisory, Red Hat Bugzilla, Percona Blog).

Percona published a security advisory covering CVE-2025-67733 alongside other Valkey CVEs, recommending immediate patching and access control review (Percona Blog). The Hacker Wire covered the vulnerability with a dedicated article titled "Valkey Scripting Vulnerability Allows Response Stream Tampering" shortly after disclosure. The vulnerability received moderate community attention on Bluesky and Mastodon, with security researchers noting the public PoC availability. Multiple Linux distribution security teams (Red Hat, Ubuntu, Fedora, Rocky Linux, Debian) issued advisories and package updates in the days following disclosure.