Medium · 5.5 CVE-2026-46751 EUVD-2026-39333GHSA-5w7q-2f7j-rqmm

Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.

Published Jun 25, 2026 · Updated Jun 25, 2026 · Assigned by apache

Description

A vulnerability in Apache Kvrocks.

This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0.

Users are recommended to upgrade to version 2.16.0, which fixes the issue.

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Kvrocks	2.2.0 – ≤ 2.15.0	—