Jincheng Yang

**Name of the Vulnerable Software and Affected Versions** Apache Kvrocks versions 2.0.4 through 2.15.0 **Description** A heap-based buffer overflow exists in the Redis Lua scripting cjson library used by the server. This issue occurs when the library handles specially crafted JSON input during Lua execution. A remote attacker can exploit this by sending malicious requests that trigger Lua/JSON processing, such as through EVAL or EVALSHA script paths, without requiring prior authentication if the instance is exposed. This can lead to remote code execution and full compromise of the process and the underlying host. **Recommendations** Upgrade to version 2.16.0.