CVE-2025-25069

A Cross-Protocol Scripting vulnerability exists in Apache Kvrocks (versions 1.0 through 2.11.0). The software fails to detect the presence of Host: or POST headers in RESP requests , allowing valid HTTP requests to be processed as RESP requests. This misinterpretation of input can trigger uninten...

CVE-2025-26413

Apache Kvrocks versions through 2.11.1 are vulnerable to an Improper Input Validation flaw within the SETRANGE command. The application fails to verify if the offset input is a positive integer, allowing it to be used as an out-of-range string index. This flaw can lead to a server crash . To reme...

CVE-2025-59790

Apache Kvrocks , a distributed key-value NoSQL database, is vulnerable to an elevation of privilege due to improper privilege management in the RESET command . An attacker can exploit this flaw to gain administrator privileges on the affected system. This issue impacts versions v2.9.0 through v2....

CVE-2025-59792

The distributed key-value NoSQL database Apache Kvrocks is vulnerable to an information disclosure flaw in the MONITOR command . This vulnerability allows an attacker to obtain sensitive information by exposing plaintext credentials . The issue affects versions 1.0.0 through 2.13.0 . To resolve t...