Which versions of Apache Kvrocks are affected by EUVD-2026-39332?

Apache Kvrocks, a Redis-compatible distributed key-value store, contains a critical memory corruption vulnerability (CVSS 10.0) in its Lua scripting engine exploitable by remote unauthenticated…

How to fix or mitigate EUVD-2026-39332?

Within 24 hours: Inventory all systems running Apache Kvrocks and audit network exposure to untrusted sources. Within 7 days: Restrict network access to Kvrocks instances to internal networks and known trusted clients only; disable EVAL/EVALSHA Lua scripting commands at the application layer if operationally feasible. Within 30 days: Continuously monitor Apache Kvrocks security advisories for patch release; develop and test upgrade or migration procedures for affected versions once patches become available.

Apache Kvrocks EUVD-2026-39332

Q: What is the CVSS score of EUVD-2026-39332?

EUVD-2026-39332 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-46752 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-06-25

GHSA-8g2g-w8wp-x78h

Path Traversal Buffer Overflow Apache Heap Overflow

10.0

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Exploitation needs EVAL/scripting access, which is typically authenticated in real deployments, so PR:L rather than PR:N; network vector and low complexity, memory corruption yields high C/I/A within the process (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 25, 2026 - 09:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 25, 2026 - 09:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 25, 2026 - 09:23 vuln.today

cvss_changed

CVSS changed

Jun 25, 2026 - 09:23 NVD

10.0 (CRITICAL)

Analysis Generated

Jun 25, 2026 - 04:46 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Stack Buffer Overflow in Apache Kvrocks Lua Engine - CVE-2026-46752 Jun 25, 2026

AnalysisAI

Memory corruption in Apache Kvrocks' embedded Lua scripting engine allows a client able to run EVAL/EVALSHA commands to trigger a stack buffer overflow in the bit.tohex() function, potentially crashing the server or corrupting process memory toward code execution. Kvrocks is a Redis-protocol-compatible distributed key-value store, and this flaw was disclosed via the oss-security mailing list on 2026-06-25 alongside three other Kvrocks issues. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Apache Kvrocks is a RocksDB-backed, Redis-compatible NoSQL datastore that embeds a Lua interpreter to support server-side scripting via the EVAL family of commands. The vulnerability resides in the LuaJIT-style 'bit' library helper bit.tohex(), which formats integers into hexadecimal strings; insufficient bounds checking on the output buffer lets a crafted argument write past the end of a fixed-size stack buffer. The CWE assigned by the source is CWE-122 (Heap-Based Buffer Overflow), yet the advisory title explicitly says 'Stack buffer overflow' and the tags list both Heap Overflow and Buffer Overflow - this is an inconsistency in the source data that should be confirmed against the upstream Apache advisory before relying on the exact memory region.

RemediationAI

No vendor-released patch version is identified in the available data; the primary action is to upgrade to the fixed Apache Kvrocks release named in the official advisory at https://lists.apache.org/thread/11sr3bkkhkk0q01odgw6ddsj7fzo31pt (verify the exact patched version there before deploying). Until patched, the most effective compensating control is to restrict who can run scripts: enable and enforce a strong requirepass/auth so anonymous clients cannot issue EVAL, and where the workload does not depend on Lua, disable or restrict server-side scripting - the trade-off is that any application relying on EVAL/EVALSHA will break. Additionally, place Kvrocks behind network segmentation so its port (default 6666) is reachable only from trusted application hosts rather than the public internet, accepting the operational constraint that client connectivity must be explicitly allow-listed. These same controls also mitigate the companion Lua and RESTORE issues disclosed in the same batch.