Unrated
Apache Kvrocks: The server was crashed by the negative offset
CVE-2025-26413
First seen on SecPulse
Original description The description as published by the source.
Improper Input Validation vulnerability in Apache Kvrocks.
The SETRANGE command didn't check if the offset input is a positive integer and use it as an index
of a string. So it will cause the server to crash due to its index is out of range.
This issue affects Apache Kvrocks: through 2.11.1.
Users are recommended to upgrade to version 2.12.0, which fixes the issue.
References
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com