Answer in brief
CVE-2025-67733 records a High severity (CVSS 8.5) vulnerability in Valkey Affected by RESP Protocol Injection via Lua error_reply. The current sources do not mark it as known exploited. The current feed maps valkey-io/valkey (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps valkey-io/valkey (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| valkey-io/valkeygeneric | < 7.2.12 || >= 8.0.0, < 8.0.7 || >= 8.1.0, < 8.1.6 || >= 9.0.0, < 9.0.2 | Not reported |
Published upstream
Feb 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 15, 2026
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-67733 records a High severity (CVSS 8.5) vulnerability in Valkey Affected by RESP Protocol Injection via Lua error_reply. The current sources do not mark it as known exploited. The current feed maps valkey-io/valkey (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps valkey-io/valkey (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| valkey-io/valkeygeneric | < 7.2.12 || >= 8.0.0, < 8.0.7 || >= 8.1.0, < 8.1.6 || >= 9.0.0, < 9.0.2 | Not reported |
Published upstream
Feb 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 15, 2026
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.
Quoted source text, attributed separately from HOL analysis.