Apache Kvrocks 2.2.0-2.15.0 Remote Code Execution Vulnerability
CVE-2026-46751 Published on June 25, 2026

Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.
A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-46751 can be exploited with network access. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
PASSIVE

Products Associated with CVE-2026-46751

Want to know whenever a new CVE is published for Apache Kvrocks? stack.watch will email you.

Apache Kvrocks
 

Affected Versions

Apache Software Foundation Apache Kvrocks:

Exploit Probability

EPSS
0.32%
Percentile
24.77%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.