PT-2026-52226 · Apache · Apache Kvrocks
CVSS v4.0
10
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Apache Kvrocks versions 2.0.4 through 2.15.0
Description
A heap-based buffer overflow exists in the Redis Lua scripting cjson library used by the server. This issue occurs when the library handles specially crafted JSON input during Lua execution. A remote attacker can exploit this by sending malicious requests that trigger Lua/JSON processing, such as through EVAL or EVALSHA script paths, without requiring prior authentication if the instance is exposed. This can lead to remote code execution and full compromise of the process and the underlying host.
Recommendations
Upgrade to version 2.16.0.
Fix
RCE
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Kvrocks