An improper input validation vulnerability in Apache Kvrocks allows the SETRANGE command to accept an invalid `offset` input, which can lead to server crashes due to out-of-range indexing. This issue affects versions of Apache Kvrocks up to 2.11.1. Users are advised to upgrade to version 2.12.0 to resolve the issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-26413 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted SETRANGE command with an invalid `offset` value to the Apache Kvrocks server. This will trigger the improper input validation, causing the server to crash due to an out-of-range index.
Affected Products
- Apache Kvrocks: A distributed key-value store that is affected up to version 2.11.1.
Mitigation
To mitigate this vulnerability, users should upgrade their Apache Kvrocks installations to version 2.12.0 or later, which includes the necessary fixes to prevent improper input validation.