CVE-2026-46751 Denial of service in Apache Kvrocks
Attackers can crash the Apache Kvrocks server by loading unvalidated bytecode via Lua EVAL scripts due to an unsafe loadstring function in the sandbox.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-46751?
CVE-2026-46751 is a medium-severity denial of service vulnerability in Apache Kvrocks, published on 25 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A vulnerability in Apache Kvrocks.
This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0.
Users are recommended to upgrade to version 2.16.0, which fixes the issue.
Which versions are affected by CVE-2026-46751?
How do I fix CVE-2026-46751?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-46751 being exploited?
There is no known exploitation of CVE-2026-46751 in the wild and no public exploit code.
Sources
Also known as GHSA-5w7q-2f7j-rqmm, MINI-7pmg-4h9m-798q.