oss-sec mailing list archives

CVE-2026-46751: Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.

From: Hulk Lin <hulk () apache org>
Date: Thu, 25 Jun 2026 02:21:08 +0000

Severity: 

Affected versions:

- Apache Kvrocks (apache/kvrocks) 2.2.0 through 2.15.0

Description:

A vulnerability in Apache Kvrocks.

This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0.

Users are recommended to upgrade to version 2.16.0, which fixes the issue.

Credit:

4ra2n (A code security AI agent) (finder)

References:

https://kvrocks.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-46751

Current thread:

CVE-2026-46751: Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service. Hulk Lin (Jun 24)