CVE-2025-26413 Apache Kvrocks: The server was crashed by the negative offset

What is CVE-2025-26413?

CVE-2025-26413 is a high-severity vulnerability in Apache Kvrocks, published on 22 Apr 2025.

Official description

Improper Input Validation vulnerability in Apache Kvrocks.

The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is  out of range. This issue affects Apache Kvrocks: through 2.11.1.

Users are recommended to upgrade to version 2.12.0, which fixes the issue.

Weakness: CWE-20

Which versions are affected by CVE-2025-26413?

It affects 1 product.

Products include Apache Kvrocks.

How do I fix CVE-2025-26413?

No fix has been published for CVE-2025-26413 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-26413 being exploited?

There is no known exploitation of CVE-2025-26413 in the wild and no public exploit code.

Other vulnerabilities in Apache Kvrocks

• CVE-2025-25069 Apache Kvrocks: Cross-Protocol Scripting Vulnerability Medium 6.5
• CVE-2025-59790 Apache Kvrocks: RESET command grants admin privileges Medium 5.4
• CVE-2025-59792 Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6935-g2xg-qvf4.