SB20260824126 - Multiple vulnerabilities in Apache Kvrocks

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824126

SB20260824126 - Multiple vulnerabilities in Apache Kvrocks

Published: August 24, 2026

Security Bulletin ID SB20260824126
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-41566)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform unauthorized actions.

The vulnerability exists due to improper access control in the APPLYBATCH command when handling command requests. A remote user can invoke the APPLYBATCH command with insufficient privileges to perform unauthorized actions.


2) Path traversal (CVE-ID: CVE-2026-45188)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write files outside the intended directory.

The vulnerability exists due to path traversal in the replication fullsync filename handling when processing a crafted filename during replication. A remote user can supply a crafted relative path to write files outside the intended directory.


3) Exposed dangerous method or function (CVE-ID: CVE-2026-46751)

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper neutralization of unsafe functionality in the Lua sandbox when processing EVAL scripts. A remote user can load crafted, unvalidated bytecode to cause a denial of service.


4) Heap-based buffer overflow (CVE-ID: CVE-2026-46752)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the cjson library used by Redis Lua when processing crafted input to bit.tohex(). A remote user can send specially crafted input to trigger memory corruption and cause a denial of service.


5) Integer overflow (CVE-ID: CVE-2026-54226)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the RESTORE IntSet processing in Apache Kvrocks when handling crafted RESTORE input. A remote attacker can send specially crafted RESTORE data to cause a denial of service.


Remediation

Install update from vendor's website.

References