Security readout for executives and security teams
Plain-English summary
Valkey can let an authenticated user corrupt the response stream seen on the same client connection by abusing Lua script error handling. This can cause tampered or confusing data responses and service disruption. The provided sources name fixed Valkey releases, so exposed systems should be updated promptly.
Executive priority
Treat this as a high-priority patching item for Valkey-backed services, especially shared environments. The issue can affect data integrity seen by clients and service availability, but provided sources do not establish active exploitation.
Technical view
Before Valkey 9.0.2, 8.1.6, 8.0.7, and 7.2.12, Lua error_reply handling mishandles null characters, enabling RESP protocol injection. The CVSS 3.1 score is 8.5 with low complexity, required low privileges, changed scope, low integrity impact, and high availability impact.
Likely exposure
Exposure is likely where Valkey runs below the fixed versions and permits users or applications to execute scripting commands. Risk is higher in shared, multi-tenant, or connection-pooled environments where response stream corruption could affect other users sharing a connection.
Exploitation context
The provided bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires network access and low privileges, not user interaction. Sources describe impact as injection of arbitrary information into the response stream for the given client.
Researcher notes
Focus validation on version ranges and whether Lua scripting is reachable by low-privileged users. The root issue is improper null character handling in Lua error_reply, mapped to CWE-170 and CWE-74. Avoid assuming cross-client impact beyond the same connection described in sources.
Mitigation direction
- Upgrade Valkey to 9.0.2, 8.1.6, 8.0.7, or 7.2.12 or later.
- Apply applicable Red Hat errata for Red Hat-packaged Valkey deployments.
- Prioritize systems where scripting commands are available to untrusted or tenant users.
- Review vendor guidance before applying compensating controls not named in advisories.
Validation and detection
- Inventory Valkey instances and record exact major and patch versions.
- Identify deployments below 7.2.12, 8.0.7, 8.1.6, or 9.0.2.
- Review whether applications expose scripting commands to low-privileged users.
- Check Red Hat advisory status for affected packaged environments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-170: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-74: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-67733 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H3.14.7GitHub_MCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H2.84.2redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.5HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-02-23T21:03:05.837Z: Reported to Red Hat.
- 2026-02-23T19:39:29.136Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2mCVE reference, GitHub_M · x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2025-67733CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2442025CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67733.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:5445CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3443CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3507CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Null Termination
Improper Null Termination represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.