CVE-2025-67733: Lfprojects Valkey XSS Vulnerability

CVE-2025-67733 Overview

CVE-2025-67733 is a Code Injection vulnerability affecting Valkey, a distributed key-value database. The vulnerability exists in the error handling code for Lua scripts, which does not properly handle null characters. A malicious user can exploit this flaw by using scripting commands to inject arbitrary information into the response stream for a given client, potentially corrupting or returning tampered data to other users on the same connection.

Critical Impact

Authenticated attackers can inject malicious content into response streams, leading to data corruption, integrity violations, and potential denial of service conditions affecting shared database connections.

Affected Products

• Valkey versions prior to 9.0.2
• Valkey versions prior to 8.1.6
• Valkey versions prior to 8.0.7
• Valkey versions prior to 7.2.12

Discovery Timeline

• 2026-02-23 - CVE-2025-67733 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-67733

Vulnerability Analysis

This vulnerability stems from improper input validation in Valkey's Lua scripting engine, specifically in the error handling code path. When processing Lua script errors, the application fails to properly sanitize null characters, allowing attackers to manipulate the response stream.

The flaw is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as injection vulnerabilities. In this case, the downstream component is the response stream parser that processes data returned to connected clients.

An authenticated attacker with scripting command privileges can craft malicious Lua scripts containing embedded null characters in error-triggering code paths. When the error handler processes these scripts, the null characters are not properly escaped, allowing the attacker to inject arbitrary data into the response stream. This injected data can then be returned to other users sharing the same database connection, leading to data integrity issues or service disruption.

Root Cause

The root cause of CVE-2025-67733 lies in the Lua script error handling code within Valkey. The error handler does not implement proper validation or sanitization of null characters (\0) when constructing error response messages. Null characters have special significance in C-based string handling and can truncate strings or allow data to bleed between memory boundaries when not properly managed.

When a Lua script triggers an error condition containing null characters, the error handling routine passes these characters directly to the response stream without proper encoding or escaping. This allows the attacker to effectively terminate the error message prematurely and inject additional response data that gets interpreted as legitimate server responses by connected clients.

Attack Vector

The attack requires network access and authenticated access to execute Lua scripting commands on the Valkey server. The attacker exploits the vulnerability through the following mechanism:

1. The attacker connects to a Valkey instance with privileges to execute Lua scripts
2. A specially crafted Lua script is executed that triggers an error condition containing null character sequences
3. The error handler fails to properly sanitize these null characters when constructing the response
4. Arbitrary data injected after the null character corrupts the response stream
5. Other clients sharing the connection may receive corrupted or tampered data

The vulnerability is particularly impactful in shared database connection scenarios, such as connection pooling configurations commonly used in production environments. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-67733

Indicators of Compromise

• Unusual Lua script execution patterns with embedded null characters or non-printable characters
• Client-side reports of corrupted or unexpected data being returned from Valkey queries
• Anomalous response sizes or malformed responses in connection logs
• Unexpected script errors in Valkey logs, particularly those containing binary data

Detection Strategies

• Monitor Lua script execution logs for scripts containing null bytes or other control characters
• Implement response validation on client applications to detect malformed or unexpected responses
• Deploy network-level monitoring to identify suspicious patterns in Valkey protocol traffic
• Review scripting command access logs for unusual activity from specific users or connections

Monitoring Recommendations

• Enable verbose logging on Valkey instances to capture detailed scripting activity
• Implement alerting for script execution failures with unusual error messages
• Monitor connection pool health metrics for signs of response stream corruption
• Audit user access to scripting commands and restrict to trusted principals only

How to Mitigate CVE-2025-67733

Immediate Actions Required

• Upgrade Valkey to patched versions: 9.0.2, 8.1.6, 8.0.7, or 7.2.12 immediately
• Restrict access to Lua scripting commands using ACLs to limit exposure to trusted users only
• Review and audit existing Lua scripts deployed in your environment for suspicious patterns
• Enable logging and monitoring for scripting command execution as an interim detection measure

Patch Information

Linux Foundation Projects has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions based on their current deployment:

For complete patch details and upgrade instructions, consult the Valkey Security Advisory on GitHub.

Workarounds

• Disable Lua scripting functionality if not required for your use case by removing scripting command ACLs
• Implement strict ACL policies to limit scripting commands to only essential, trusted users
• Use dedicated connections per client rather than connection pooling to limit cross-user impact
• Deploy network segmentation to restrict which systems can execute scripts against Valkey instances

# Example: Restrict scripting commands using Valkey ACL
# Create a restricted user without scripting capabilities
ACL SETUSER restricted_user on >password ~* &* +@all -@scripting

# Verify the user cannot execute Lua scripts
ACL LIST