Non notée
CVE-2025-25069 A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks
Description
A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when it is chained with SSRF. It is similiar to CVE-2016-10517 in Redis. This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0. Users are recommended to upgrade to version 2.11.1, which fixes the issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Kvrocks 2.11 | premières → 2.11.0 | Pas de correctif indiqué |
Références
- www.cve.org www.cve.org
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Kvrocks
Les 9 CVE de Apache Kvrocks →
CVE-2026-41566
Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrocks
9.4
Critique
CVE-2026-45188
Relative Path Traversal vulnerability in Apache Kvrocks
2.4
Faible
CVE-2026-46751
A vulnerability in Apache Kvrocks
5.5
Moyenne
CVE-2026-46752
Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks
10.0
Critique