AI BriefingAnalysis of Redis and Valkey Security Vulnerability (CVE ID Included)
Key point
Analyzes a RESP injection vulnerability (CVE-2025-67733) occurring during Lua script execution in Valkey and Redis.
Details
This covers a RESP injection attack that exploits characteristics of the RESP (Redis Serialization Protocol) used by Valkey and Redis. An attacker can execute malicious Lua scripts via the EVAL command to cause socket poisoning on the server, tamper with data, or carry out DoS (Denial of Service) attacks.
The core of the vulnerability lies in the Lua script execution flow and the way errors are handled. The vulnerability occurs during the process in which an error table containing a malicious payload created via redis.error_reply() is sent to the client through the error() built-in function.
Key vulnerability information:
- CVE ID: CVE-2025-67733
- CVSS score: 8.5/10 (High)
- Affected versions:
- Valkey: 9.0.1 and below
- Redis: 8.4.1 and below
- Patch recommendation: Update to the latest security-patched versions (Valkey 9.0.2, Redis 8.4.2, etc.) is required.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Australian PM Reports OpenAI Agent Hacked Medicare Portal in Believed First Known AI-Driven Government Breach
Hugging Face CEO details lessons from first public agent cyberattack, advocates for open-source defenseOWASP Ranks Agent Goal Hijack as Top Vulnerability; Reveals Key Attack Cases and Defense Strategies