Apache · Apache Kvrocks · CVE-2025-26413
**Name of the Vulnerable Software and Affected Versions**
Apache Kvrocks versions through 2.11.1
**Description**
The issue is related to improper input validation in the SETRANGE command, which fails to check if the `offset` input is a positive integer. This can cause the server to crash due to an out-of-range index.
**Recommendations**
For Apache Kvrocks versions through 2.11.1, upgrade to version 2.12.0 to fix the issue. As a temporary workaround, consider restricting the use of the SETRANGE command until the issue is resolved.