What’s Vulnerable › Products

Apache Software Foundation Apache Kvrocks vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your Apache Software Foundation Apache Kvrocks version is affected

Latest Apache Software Foundation Apache Kvrocks vulnerabilities

• CVE-2026-54226 — Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS (CVSS 6.4)
• CVE-2026-46752 — Apache Kvrocks: Stack buffer overflow in Lua bit.tohex() (CVSS 10.0)
• CVE-2026-46751 — Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service. (CVSS 5.5)
• CVE-2026-45188 — Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling (CVSS 2.4)
• CVE-2026-41566 — Apache Kvrocks: Improper permission for the APPLYBATCH command (CVSS 9.4)
• CVE-2025-59792 — Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins (CVSS 5.3)
• CVE-2025-59790 — Apache Kvrocks: RESET command grants admin privileges (CVSS 5.4)
• CVE-2025-26413 — Apache Kvrocks: The server was crashed by the negative offset (CVSS 7.5)
• CVE-2025-25069 — Apache Kvrocks: Cross-Protocol Scripting Vulnerability (CVSS 6.5)