CVE Intelligence
Analysis AI-assisted

CVE-2026-46752: Apache Kvrocks: heap overflow in the Lua cjson library

CVE-2026-46752 is a heap-based buffer overflow (CWE-122) in the cjson library used through Lua scripting in Apache Kvrocks. The record states that versions from 2.0.4 through 2.15.0 are affected and recommends upgrading to 2.16.0. The record rates it critical with a CVSS 4.0 base score of 10, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-46752 is a heap-based buffer overflow affecting the cjson library used through Lua scripting in Apache Kvrocks. The CNA security@apache.org published the record on 2026-06-25 and the record states the issue is fixed in version 2.16.0.

Impact

  • The CVSS 4.0 vector in the record indicates a network attack vector, no required privileges and no required user interaction.
  • The vector lists high confidentiality, integrity and availability impact on the vulnerable system, and high impact on subsequent systems.
  • The CVSS 4.0 base score is 10, which the record classifies as critical.

Affected products and versions

  • The description states that Apache Kvrocks versions from 2.0.4 through 2.15.0 are affected.
  • The structured affected and fixes fields in the record are empty, so the description is the only version source available here.
  • Version 2.16.0 is the version the description recommends for upgrade.

Exploitation status

  • The record shows KEV listed as false, so no entry in the CISA KEV catalog is recorded for this CVE.
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The primary recommendation in the record is to upgrade Apache Kvrocks to version 2.16.0.
  • Until the upgrade is applied, reducing network exposure of Kvrocks instances and limiting access to trusted clients is a reasonable defensive measure. The record does not describe a specific workaround.
  • Consult the vendor advisory linked in the references for the authoritative remediation details.

Detection guidance

  • Inventory all Kvrocks deployments and record their exact versions, especially those between 2.0.4 and 2.15.0.
  • Review access controls and the origin of clients that can run Lua scripts against the service.
  • Monitor service logs and process stability for unexpected crashes or restarts, which can be signs of memory corruption issues, without treating them as confirmation of compromise.

Limitations of the available information

  • The title field in the record is null, so the title in this analysis was written from the description.
  • EPSS and SSVC data are missing, so exploitation likelihood is unknown from the record.
  • The structured affected and fixes lists are empty, so version ranges come only from the description text.
  • No exploit details, proof-of-concept references or vendor-specific technical analysis are included in the record.

Frequently asked questions

Which Apache Kvrocks versions are affected by CVE-2026-46752?

The record description states that versions from 2.0.4 through 2.15.0 are affected. The structured affected list in the record is empty, so the description is the source for this range.

What version should be used to fix this issue?

The record recommends upgrading to Apache Kvrocks version 2.16.0, which the description says fixes the issue.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.