A high-severity injection vulnerability in the Valkey distributed database allows authenticated attackers to manipulate response streams and disrupt service availability.

This is an injection flaw (CWE-74) resulting from improper handling of null characters in Lua script error processing. An authenticated attacker can exploit this to inject malicious data into client response streams, causing data tampering or service disruption.

The vulnerability carries a CVSS score of 8.5, reflecting a significant risk to data integrity and system availability. Successful exploitation allows an attacker to corrupt database responses, which can result in the loss of data reliability, unauthorized information access, and potential denial of service for other users sharing the same connection.

Immediate Action: Update Valkey to version 7.2.12, 8.0.7, 8.1.6, 9.0.2, or later to incorporate the necessary error handling patches.

Proactive Monitoring: Review application and database logs for anomalous Lua script execution patterns or unexpected error messages related to character encoding.

Compensating Controls: Restrict access to database scripting commands and implement strict input validation for any user-supplied scripts if immediate patching is not possible.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Given the potential for data corruption and service disruption, organizations should prioritize upgrading their Valkey instances to the specified patched versions. While authentication is required to trigger the flaw, the impact on data integrity necessitates immediate attention to prevent malicious actors from compromising the reliability of the database environment.