Apache Software Foundation Apache Kvrocks vulnerabilities

CVE-2026-46752 [CRITICAL] CWE-122 CVE-2026-46752: Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.0.4 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVE-2026-41566 [CRITICAL] CWE-280 CVE-2026-41566: Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks. This i Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: 2.8.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVE-2025-26413 [HIGH] CWE-20 CVE-2025-26413: Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. Users are recommended to upgrade to version 2.12.0, which

CVE-2016-10517 [HIGH] CWE-254 CVE-2016-10517: networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for PO networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).

CVE-2026-54226 [MEDIUM] CWE-190 CVE-2026-54226: A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.6.0 through 2.15.0. U A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.6.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVE-2026-46751 [MEDIUM] CVE-2026-46751: A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0. U A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVE-2025-59790 [MEDIUM] CWE-269 CVE-2025-59790: Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: f Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.

CVE-2025-59792 [MEDIUM] CWE-312 CVE-2025-59792: Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue af Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.

CVE-2026-45188 [LOW] CWE-23 CVE-2026-45188: Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1. Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.