CVE Intelligence

Apache Software Foundation Kvrocks vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Apache Software Foundation Kvrocks: 7 record(s), with affected versions and fixes.
cpe:2.3:a:apache:kvrocks

CVE-2026-54226 Medium · 6.4 CWE-190 Jun 25, 2026
Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS
A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.6.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.
CVE-2026-46752 Critical · 10.0 CWE-122 Jun 25, 2026
Apache Kvrocks: heap overflow in the Lua cjson library
Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.0.4 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.
CVE-2026-46751 Medium · 5.5 Jun 25, 2026
Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.
A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.
CVE-2026-45188 Low · 2.4 CWE-23 Jun 25, 2026
Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling
Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.
CVE-2026-41566 Critical · 9.4 CWE-280 Jun 25, 2026
Apache Kvrocks: Insufficient Permissions Handling Vulnerability (CVE-2026-41566)
Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: 2.8.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.
CVE-2025-59792 Medium · 5.3 CWE-312 Nov 28, 2025
Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins
Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.
CVE-2025-59790 Medium · 5.4 CWE-269 Nov 28, 2025
Apache Kvrocks: RESET command grants admin privileges
Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.