Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0309

NIXPKGS-2026-0309
published 6 months, 2 weeks ago
Permalink CVE-2025-67733
8.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): None (N)
  • Integrity (I): Low (L)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): High (H)
updated 6 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 6 months, 2 weeks ago
  • @mweinelt ignored
    5 packages
    • python312Packages.valkey
    • python313Packages.valkey
    • python314Packages.valkey
    • python313Packages.libvalkey
    • python314Packages.libvalkey
    6 months, 2 weeks ago
  • @mweinelt accepted 6 months, 2 weeks ago
  • @mweinelt published on GitHub 6 months, 2 weeks ago
Valkey Affected by RESP Protocol Injection via Lua error_reply

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

Affected products

valkey
  • ==>= 8.0.0, < 8.0.7
  • ==>= 9.0.0, < 9.0.2
  • ==>= 8.1.0, < 8.1.6
  • ==< 7.2.12

Matching in nixpkgs

pkgs.valkey

High-performance data structure server that primarily serves key/value workloads

Ignored packages (5)

Package maintainers

https://github.com/valkey-io/valkey/security/advisories/GHSA-p876-p7q5-hv2m