Which versions of Apache Kvrocks are affected by CVE-2026-54226?

Apache Kvrocks is vulnerable to a critical remote denial-of-service vulnerability (CVE-2026-54226) triggered through the RESTORE command, which can crash server instances and disrupt dependent…

How to fix or mitigate CVE-2026-54226?

Within 24 hours: Identify all systems running Apache Kvrocks and assess network exposure of each instance; implement firewall rules to restrict command access to trusted networks only. Within 7 days: Enable network isolation for Kvrocks instances; disable or restrict the RESTORE command if operationally feasible; deploy monitoring and alerting for unusual command patterns and unexpected server restarts. Within 30 days: Subscribe to Apache Kvrocks security mailing list and track vendor advisories; prepare upgrade procedure and test with patched version upon release; conduct security audit for related vulnerabilities (CVE-2026-46751, CVE-2026-46752).

Apache Kvrocks CVE-2026-54226

Q: What is the CVSS score of CVE-2026-54226?

CVE-2026-54226 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:D/RE:L/U:Amber. EPSS exploitation probability: 0.3%.

EUVD-2026-39331 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-06-25

GHSA-8x67-x273-g37h

Buffer Overflow Apache Integer Overflow

6.4

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:D/RE:L/U:Amber

vuln.today AI

6.5 MEDIUM

Network-reachable command requires at minimum ability to issue commands (PR:L assumed for Redis-compatible auth); DoS-only impact, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:I/V:D/RE:L/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 25, 2026 - 09:23 NVD

6.4 (MEDIUM)

Analysis Generated

Jun 25, 2026 - 04:47 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Remote denial-of-service in Apache Kvrocks via an integer overflow in the RESTORE command's IntSet deserialization path. An attacker who can send commands to a Kvrocks instance can supply a crafted RDB-serialized IntSet payload to the RESTORE command, triggering an integer overflow that crashes the server process. This vulnerability was disclosed pre-NVD via the oss-security mailing list on 2026-06-25 alongside two other Kvrocks CVEs (CVE-2026-46751, CVE-2026-46752), suggesting a coordinated security audit of the project; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Apache Kvrocks is a Redis-compatible NoSQL database engine that uses RocksDB as its persistent storage backend, implementing the Redis Serialization Protocol (RESP) and supporting Redis commands including RESTORE. The RESTORE command accepts RDB (Redis Database) binary-serialized data and deserializes it into a live key. IntSet is a compact, sorted integer array data structure used internally to represent small sets containing only integer members. The vulnerability occurs during deserialization of a RESTORE payload that encodes an IntSet: an integer overflow in the length or size field processing causes incorrect memory allocation or bounds calculation, ultimately leading to a process crash and denial of service. While no CWE has been formally assigned by NVD (pre-NVD disclosure), the root cause class is consistent with CWE-190 (Integer Overflow or Wraparound) potentially compounding into CWE-125 (Out-of-bounds Read) or CWE-787 (Out-of-bounds Write). The same oss-security batch reveals Kvrocks also had a Lua sandbox escape (CVE-2026-46751) and a Lua stack buffer overflow (CVE-2026-46752), indicating systemic input validation weaknesses in the project's serialization and scripting layers.

RemediationAI

Upgrade to the fixed version of Apache Kvrocks as released by the Apache Software Foundation - the exact patched version number is not available in the current pre-NVD disclosure and should be obtained from the official oss-security post at https://www.openwall.com/lists/oss-security/2026/06/25 and the Apache Kvrocks project release page. Upstream fix availability (PR/commit) is referenced by the project maintainer disclosure but a tagged released patched version has not been independently confirmed at time of analysis. As an interim compensating control, restrict network access to the Kvrocks port (default 6666) using firewall rules or security groups to only trusted internal clients, reducing the pool of potential attackers who can issue RESTORE commands. If RESTORE is not required for any application workflow, consider blocking or rate-limiting access to the RESTORE command using a Redis proxy (e.g., Twemproxy, Envoy) placed in front of the Kvrocks instance - this eliminates the attack surface without requiring a service restart, though it adds architectural complexity. Enabling Kvrocks authentication (requirepass) limits exposure to credentialed users but does not remove the vulnerability. Monitor for the formal NVD entry and vendor advisory for confirmed fix version.