🚨 CRITICAL - Network-triggered Lua cjson heap overflow in Apache Kvrocks (CVE-2026-46752) Apache Kvrocks is vulnerable due to a heap overflow in the Redis Lua scripting cjson library used by the server. The root cause is a classic heap-based buffer overflow in cjson when handling crafted JSON input during Lua execution. An attacker can exploit this remotely by sending malicious requests that invoke Lua/JSON processing (e.g., EVAL/EVALSHA-style script paths) with no prior authentication if the instance is exposed. Successful exploitation can lead to remote code execution and full compromise of the Kvrocks process and underlying host. 👉 Affected: Apache Kvrocks 2.0.4–2.15.0 | Upgrade to 2.16.0
Post summary
CVE-2026-46752 is a heap‑based buffer overflow in Apache Kvrocks’s cjson library that allows remote code execution; affected releases are 2.0.4–2.15.0 and upgrading to 2.16.0 provides a fix.