PT-2026-21544 · Valkey+4 · Valkey+4

Published 2026-02-23 · Updated 2026-05-18 · CVE-2025-67733

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Valkey versions prior to 9.0.2 Valkey versions prior to 8.1.6 Valkey versions prior to 8.0.7 Valkey versions prior to 7.2.12

Description A flaw in the error handling code for Lua scripts does not properly handle null characters. This allows a malicious user to use scripting commands to inject arbitrary information into the response stream for a given client, which could lead to corrupting or returning tampered data to other users on the same connection.

Recommendations Update to version 9.0.2 Update to version 8.1.6 Update to version 8.0.7 Update to version 7.2.12

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALSA-2026:3443

ALSA-2026:3507

AZL-78317

BDU:2026-07333

BIT-VALKEY-2025-67733

CVE-2025-67733

GHSA-P876-P7Q5-HV2M

OPENSUSE-SU-2026:10266-1

OPENSUSE-SU-2026:20776-1

RHSA-2026:3443

RHSA-2026:3507

RHSA-2026:5445

SUSE-SU-2026:0685-1

SUSE-SU-2026:0848-1

SUSE-SU-2026:21814-1

USN-8106-1

Affected Products

Linuxmint

Red Os

Rocky Linux

Ubuntu

Valkey

References · 58

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67733.json · Exploit
• https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:3507 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0848-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-67733 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67733 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-67733 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10266-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07333 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2025-67733 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-67733 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78317 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-3507.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-8106-1 · Vendor Advisory