CVE-2025-67733

HIGH

Valkey <9.0.2/8.1.6/8.0.7/7.2.12 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-67733. PoCs published by JYlab.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2025-67733, demonstrating a RESP protocol injection vulnerability in Valkey/Redis via Lua script error messages. The attack involves poisoning the socket buffer with malicious RESP data, which is then read by subsequent legitimate requests.

Description

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

Exploits (2)

nomisec WORKING POC
by JYlab · poc
https://github.com/JYlab/CVE-2025-67733

This repository contains a functional proof-of-concept for CVE-2025-67733, demonstrating a RESP protocol injection vulnerability in Valkey/Redis via Lua script error messages. The attack involves poisoning the socket buffer with malicious RESP data, which is then read by subsequent legitimate requests.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Valkey/Redis
No auth needed
Prerequisites: Access to a Valkey/Redis instance · Ability to execute Lua scripts on the target
devstral-2 · analyzed Feb 24, 2026 Full analysis →
nomisec WORKING POC
by JYlab · poc
https://github.com/JYlab/CVE-2025-67733-RESP-Injection-PoC

This repository contains a functional proof-of-concept for CVE-2025-67733, demonstrating a RESP protocol injection vulnerability in Valkey/Redis via Lua script error messages. The attack involves poisoning the socket buffer with malicious RESP data, leading to unauthorized data manipulation.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Valkey/Redis
No auth needed
Prerequisites: Access to a Valkey/Redis instance · Ability to execute Lua scripts
devstral-2 · analyzed Feb 24, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 8.5
EPSS 0.0042
EPSS Percentile 33.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-74
Status published
Products (1)
lfprojects/valkey < 7.2.12
Published Feb 23, 2026
Tracked Since Feb 23, 2026