[<prev] [day] [month] [year] [list]
Message-ID: <f0d8327d-b133-e389-a57d-b98f7185e83d@apache.org>
Date: Tue, 22 Apr 2025 05:36:49 +0000
From: Hulk Lin <hulk@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-26413: Apache Kvrocks: The server was crashed by the
negative offset
Severity: moderate
Affected versions:
- Apache Kvrocks through 2.11.1
Description:
Improper Input Validation vulnerability in Apache Kvrocks.
The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an index
of a string. So it will cause the server to crash due to its index is out of range.
This issue affects Apache Kvrocks: through 2.11.1.
Users are recommended to upgrade to version 2.12.0, which fixes the issue.
Credit:
朱少扬 (reporter)
References:
https://kvrocks.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-26413
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
