PT-2025-17489 · Apache · Apache Kvrocks

朱少扬 · Published 2025-04-22 · Updated 2025-06-23 · CVE-2025-26413

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Kvrocks versions through 2.11.1

Description The issue is related to improper input validation in the SETRANGE command, which fails to check if the offset input is a positive integer. This can cause the server to crash due to an out-of-range index.

Recommendations For Apache Kvrocks versions through 2.11.1, upgrade to version 2.12.0 to fix the issue. As a temporary workaround, consider restricting the use of the SETRANGE command until the issue is resolved.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-26413

Affected Products

Apache Kvrocks

References · 13

• https://lists.apache.org/thread/388743qrr8yq8qm0go8tls6rf1kog8dw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26413 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26413 · Vendor Advisory
• http://openwall.com/lists/oss-security/2025/04/22/1 · Note
• https://twitter.com/VulmonFeeds/status/1914605864796778697 · Twitter Post
• https://t.me/cvedetector/23490 · Telegram Post
• https://t.me/cvenotify/121765 · Telegram Post
• https://twitter.com/CVEnew/status/1914582947274928482 · Twitter Post
• https://t.me/cvenotify/126415 · Telegram Post
• https://t.me/cvenotify/119302 · Telegram Post
• https://t.me/cvenotify/119300 · Telegram Post
• https://t.me/cvetracker/22097 · Telegram Post
• https://twitter.com/oss_security/status/1914705739366490221 · Twitter Post