CVE-2026-46752
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in the cjson library in Apache Kvrocks causing Lua HEAP overflow. Affects versions from 2.0.4 to 2.15.0.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access or system crashes. Organizations should be aware of the potential threats associated with this flaw.
Recommendation
It is recommended to upgrade to version 2.16.0, which fixes the issue. Keeping software up to date is crucial for security.
Other vulnerabilities in Apache Kvrocks
See all- CVE-2026-41566Critical
CVE-2026-41566 involves improper handling of insufficient permissions in Apache Kvrocks version 2.8.0. This issue has been fixed in version 2.16.0.
- CVE-2026-54226Medium
A vulnerability in Apache Kvrocks affects versions from 2.6.0 through 2.15.0, and users are recommended to upgrade to version 2.16.0 to fix the issue.
- CVE-2026-46751Medium
A vulnerability in Apache Kvrocks affects versions from 2.2.0 through 2.15.0, and users are recommended to upgrade to version 2.16.0 to fix the issue.
- CVE-2026-45188Low
A Relative Path Traversal vulnerability in Apache Kvrocks may allow attackers to access unauthorized system resources. The issue affects versions from 1.0.0 through 2.15.0.
Original NVD description (English source)
Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.0.4 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS