Loading story…
Apache Kvrocks was reported as affected by two Redis Lua flaws, CVE-2024-31449 and CVE-2025-49844, with project-linked fixes already in place despite the absence of a formal security advisory. In the oss-sec discussion, restored Apache Kvrocks GitHub issues identified CVE-2024-31449 as a stack buffer overflow in Lua bit.tohex() and CVE-2025-49844 as a use-after-free in the Lua parser function luaY_parser, while a maintainer pull request was said to reference both vulnerabilities directly.
The disclosure became muddled after the related GitHub issues were temporarily renamed as duplicates and marked to be ignored, prompting questions on oss-sec about whether the references were valid and whether any official notice existed. Jincheng Yang said the issue titles and descriptions were restored after the rename caused confusion and said the change was not intended to conceal the bugs; he also said ASF Security planned to coordinate with the Kvrocks team to publish Kvrocks-specific CVE IDs, leaving the project in a state where fixes appear to exist but formal advisory tracking remains incomplete.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-16, Alan Coopersmith replied on oss-sec that the referenced Kvrocks issues appeared to be marked 'Duplicate - please ignore' and submitted in error, casting doubt on the public tracking and advisory status of the alleged fixes.
Yang said ASF Security planned to coordinate with the Kvrocks team to publish Kvrocks-specific CVE IDs for the vulnerabilities affecting the project.
In the oss-sec discussion, Yang stated that the impacts had been reported to the Kvrocks project, acknowledged by maintainers, and fixed already, though no formal advisory had yet been published.
Later on 2026-04-11, Jincheng Yang said he restored the original titles and content of the Kvrocks GitHub issues, identifying CVE-2024-31449 and CVE-2025-49844 and noting that a maintainer fix pull request explicitly referenced both CVEs.
On 2026-04-11, Apache Kvrocks GitHub issues #3433 and #3434 were renamed and edited to say they were submitted in error and marked as duplicates, obscuring their prior references to Redis Lua vulnerabilities.
On GitHub, Apache Kvrocks issue #3434 was opened to report that Kvrocks was affected by CVE-2025-49844, a use-after-free in the Lua parser inherited from the RocksLabs/lua code path originating from Redis. The report said the flaw could enable authenticated remote code execution when Kvrocks is built with PUC Lua (-DENABLE_LUAJIT=OFF), noted default LuaJIT builds were not affected, and described the fix approach.
On GitHub, Apache Kvrocks issue #3433 was opened to report that Kvrocks was affected by CVE-2024-31449, a stack buffer overflow in the Redis-derived RocksLabs/lua bit.tohex() implementation. The report included a redis-cli proof of concept against Kvrocks, identified the vulnerable code path, and proposed remediation based on the upstream Redis fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-46752**, a critical remotely exploitable memory corruption vulnerability in **Apache Kvrocks** affecting versions **2.0.4 through 2.15.0**. Advisory text describes the issue as a Redis Lua **heap overflow** in the `cjson` library, while the CVE title and related notices also reference a **stack buffer overflow** in `Lua bit.tohex()`, indicating unsafe Lua-related memory handling that could lead to severe impact. Apache said the flaw is fixed in **Apache Kvrocks 2.16.0** and urged affected users to upgrade. The disclosure was published through Apache and oss-security channels, and the vulnerability report credits **Jincheng Yang** as the reporter.
Jun 29, 2026
Security researcher Orange Tsai disclosed **Confusion Attacks**, a set of architectural vulnerabilities in Apache HTTP Server (`httpd`) caused by modules inconsistently interpreting and modifying shared request fields. The flaws—covering Filename, DocumentRoot, and Handler Confusion—were assigned nine CVEs, including `CVE-2024-38472`, `CVE-2024-38473` through `CVE-2024-38477`, and `CVE-2024-39573`. Depending on configuration, exploitation can permit authentication or access-control bypasses, arbitrary local-file and source-code disclosure, SSRF, XSS, local socket access, and possible remote code execution. Apache addressed the reported issues in **httpd 2.4.60**. Risk is highest where deployments use unsafe `RewriteRule` directives, PHP-FPM or `mod_proxy`, CGI-style handlers or redirects, permissive directory and symlink settings, or accessible local package files. Apache's `mod_rewrite` guidance documents hardening changes associated with `CVE-2024-38474` and `CVE-2024-38475`; administrators should avoid enabling `UnsafeAllow3F` and `UnsafePrefixStat` unless they have verified that untrusted input cannot control rewritten query strings or filesystem paths.
Sep 3, 2026
Redis disclosed five vulnerabilities affecting Redis Cloud, Redis Software, and Redis OSS/CE that could allow authenticated attackers to achieve **remote code execution**, system compromise, data exfiltration, or service disruption. The issues tracked as `CVE-2026-23479`, `CVE-2026-25243`, `CVE-2026-25588`, `CVE-2026-25589`, and `CVE-2026-23631` include an invalid memory access flaw in the `RESTORE` command, a use-after-free bug in the unblock client flow, and a Lua use-after-free condition in certain replica configurations. Public advisories and downstream alerts described four of the bugs as high severity and one as medium severity, with multiple flaws capable of leading to arbitrary code execution. Redis said **Redis Cloud** deployments had already been patched and required no customer action, while self-managed users were told to upgrade to fixed releases across Redis OSS/CE, Redis Software, RedisTimeSeries, and RedisBloom. Government and national CERT notices echoed the vendor guidance and urged administrators to review the advisories and apply updates promptly. Redis also said it had **no evidence of active exploitation** at publication time, but recommended immediate patching and hardening measures such as restricting network exposure, enforcing strong authentication, keeping protected mode enabled where appropriate, and applying least-privilege access controls.
Jun 29, 2026