CVE-2025-26413
HIGHApache Kvrocks < 2.12.0 - Improper Input Validation
Title source: ruleDescription
Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. Users are recommended to upgrade to version 2.12.0, which fixes the issue.
Scores
CVSS v3
7.5
EPSS
0.0115
EPSS Percentile
78.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Classification
CWE
CWE-20
Status
published
Affected Products (1)
apache/kvrocks
< 2.12.0
Timeline
Published
Apr 22, 2025
Tracked Since
Feb 18, 2026