CVE-2025-25069

A Cross-Protocol Scripting vulnerability exists in Apache Kvrocks (versions 1.0 through 2.11.0). The software fails to detect the presence of Host: or POST headers in RESP requests , allowing valid HTTP requests to be processed as RESP requests. This misinterpretation of input can trigger uninten...

CVE-2025-26413

Apache Kvrocks versions through 2.11.1 are vulnerable to an Improper Input Validation flaw within the SETRANGE command. The application fails to verify if the offset input is a positive integer, allowing it to be used as an out-of-range string index. This flaw can lead to a server crash . To reme...