CVE-2025-26413

CWE-20 — Improper Input Validation3 documents3 sources

Severity

7.5HIGH

EPSS

1.2%

top 21.50%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Kvrocks Apache Software Foundation Apache Kvrocks

Timeline

PublishedApr 22

Description

Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. Users are recommended to upgrade to version 2.12.0, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDapache/kvrocks< 2.12.0

▶CVEListV5apache_software_foundation/apache_kvrocks2.11.1

🔴Vulnerability Details

GHSA

GHSA-6935-g2xg-qvf4: Improper Input Validation vulnerability in Apache Kvrocks↗2025-04-22

▶

CVEList

Apache Kvrocks: The server was crashed by the negative offset↗2025-04-22

▶