CVE-2026-46752 Overview
CVE-2026-46752 is a heap-based buffer overflow [CWE-122] in the cjson Lua library bundled with Apache Kvrocks. The flaw affects Apache Kvrocks versions 2.0.4 through 2.15.0. An unauthenticated remote attacker can trigger memory corruption by submitting crafted input processed through the embedded Lua cjson routines. Successful exploitation can lead to arbitrary code execution in the context of the Kvrocks process. The project maintainers fixed the issue in version 2.16.0.
Critical Impact
Network-reachable Apache Kvrocks instances are exposed to unauthenticated heap corruption that can compromise confidentiality, integrity, and availability of the data store.
Affected Products
- Apache Kvrocks 2.0.4 through 2.15.0
- Distributions and container images shipping Kvrocks within this version range
- Apache Kvrocks 2.16.0 (fixed release)
Discovery Timeline
- 2026-06-25 - CVE-2026-46752 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-46752
Vulnerability Analysis
Apache Kvrocks embeds a Redis-compatible Lua scripting engine. That engine bundles the cjson library used to encode and decode JSON values from Lua scripts. CVE-2026-46752 is a heap overflow inside cjson parsing or serialization paths reachable through the Kvrocks scripting interface.
Because Kvrocks accepts script execution commands such as EVAL and EVALSHA over its network protocol, the vulnerable code can be reached by any client able to issue commands. The overflow corrupts heap metadata or adjacent objects in the Kvrocks process. This memory corruption class typically leads to arbitrary code execution or process compromise. The vulnerability carries an EPSS probability of 0.336%.
Root Cause
The root cause is improper bounds handling in the cjson Lua module when processing JSON payloads. Length calculations during decoding or encoding allow writes beyond the allocated heap buffer. This belongs to the [CWE-122] heap-based buffer overflow class.
Attack Vector
An attacker connects to a Kvrocks endpoint and issues a Lua script that calls cjson.decode or cjson.encode against attacker-controlled data. The crafted payload causes the library to write outside the bounds of a heap-allocated buffer. The vector is network-based, requires no authentication when scripting is exposed, and needs no user interaction.
No verified public exploit code is available. See the Apache Security Thread Discussion and the Openwall OSS Security Update for advisory details.
Detection Methods for CVE-2026-46752
Indicators of Compromise
- Unexpected crashes, restarts, or core dumps from the kvrocks process correlating with EVAL or EVALSHA commands.
- Anomalous outbound network connections initiated by the Kvrocks service following script execution.
- New or unexpected child processes spawned by the Kvrocks process account.
Detection Strategies
- Inspect Kvrocks command logs for EVAL, EVALSHA, and SCRIPT LOAD operations originating from untrusted clients.
- Hunt for Lua scripts that pass large or malformed strings into cjson.decode or cjson.encode.
- Correlate process crashes with preceding scripting traffic to identify exploitation attempts.
Monitoring Recommendations
- Enable verbose command auditing on Kvrocks and forward logs to a centralized SIEM for retention and search.
- Alert on Kvrocks process termination events and on memory protection violations reported by the host kernel.
- Monitor for first-seen client IP addresses issuing scripting commands against production Kvrocks nodes.
How to Mitigate CVE-2026-46752
Immediate Actions Required
- Upgrade Apache Kvrocks to version 2.16.0 on all production and staging instances.
- Restrict network access to Kvrocks ports using firewalls or service mesh policies so that only trusted clients can connect.
- Require authentication on every Kvrocks instance and rotate credentials after patching.
Patch Information
Apache Kvrocks 2.16.0 contains the fix for CVE-2026-46752. Refer to the Apache Security Thread Discussion for the release announcement and the Openwall OSS Security Update for the coordinated disclosure notice.
Workarounds
- Disable Lua scripting access by blocking EVAL, EVALSHA, and SCRIPT commands using ACLs until the upgrade is applied.
- Place Kvrocks behind a proxy that filters scripting commands from untrusted sources.
- Run Kvrocks under a least-privilege service account and isolate the host using container or VM boundaries to limit blast radius.
# Configuration example: restrict scripting commands via Kvrocks ACL
requirepass <strong-password>
rename-command EVAL ""
rename-command EVALSHA ""
rename-command SCRIPT ""
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
