Executive brief
Apache Kvrocks, a database compatible with Redis, is vulnerable to a critical memory flaw in its Lua scripting engine. An attacker could exploit this to crash the database service or potentially execute unauthorized commands, leading to a full system compromise. Organizations using affected versions should upgrade immediately to prevent service disruption and data theft.
Technical details
A heap-based buffer overflow (CWE-122) exists in the cjson library integrated into the Redis Lua engine of Apache Kvrocks. The vulnerability is present in versions 2.0.4 through 2.15.0. An unauthenticated remote attacker can trigger this overflow by providing specially crafted input to Lua scripts that utilize the cjson library. Successful exploitation can lead to arbitrary code execution or a complete crash of the database process. The issue is resolved in Apache Kvrocks version 2.16.0.
Affected products
- Apache Kvrocks 2.0.4 through 2.15.0
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory