Loading story…
Apache disclosed CVE-2026-46752, a critical remotely exploitable memory corruption vulnerability in Apache Kvrocks affecting versions 2.0.4 through 2.15.0. Advisory text describes the issue as a Redis Lua heap overflow in the cjson library, while the CVE title and related notices also reference a stack buffer overflow in Lua bit.tohex(), indicating unsafe Lua-related memory handling that could lead to severe impact.
Apache said the flaw is fixed in Apache Kvrocks 2.16.0 and urged affected users to upgrade. The disclosure was published through Apache and oss-security channels, and the vulnerability report credits Jincheng Yang as the reporter.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache advised affected users to upgrade to Apache Kvrocks 2.16.0 to remediate CVE-2026-46752. The fixed release was identified in the disclosure and related advisories as the recommended mitigation.
Apache disclosed CVE-2026-46752, a memory corruption vulnerability affecting Apache Kvrocks versions 2.0.4 through 2.15.0. The flaw was described as a Redis Lua cjson library issue, with references also noting a stack buffer overflow in Lua bit.tohex().
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecvefeed.io
Open sourcelists.apache.org
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Kvrocks was reported as affected by two Redis Lua flaws, **CVE-2024-31449** and **CVE-2025-49844**, with project-linked fixes already in place despite the absence of a formal security advisory. In the oss-sec discussion, restored Apache Kvrocks GitHub issues identified `CVE-2024-31449` as a stack buffer overflow in Lua `bit.tohex()` and `CVE-2025-49844` as a use-after-free in the Lua parser function `luaY_parser`, while a maintainer pull request was said to reference both vulnerabilities directly. The disclosure became muddled after the related GitHub issues were temporarily renamed as duplicates and marked to be ignored, prompting questions on oss-sec about whether the references were valid and whether any official notice existed. Jincheng Yang said the issue titles and descriptions were restored after the rename caused confusion and said the change was not intended to conceal the bugs; he also said ASF Security planned to coordinate with the Kvrocks team to publish Kvrocks-specific CVE IDs, leaving the project in a state where fixes appear to exist but formal advisory tracking remains incomplete.
Jun 29, 2026
Apache disclosed **CVE-2026-64608**, a critical vulnerability in the **Apache Fory C++** implementation that can cause heap type confusion and out-of-bounds read/write during deserialization. The flaw occurs in compatible mode when field-skip paths do not properly validate declared field types against the actual data being processed, creating a memory-corruption condition that could have severe impact on affected deployments. The issue affects **Apache Fory C++ versions `0.14.0` through before `1.4.0`** and does **not** affect other Apache Fory language implementations. Apache has advised users to upgrade to **`1.4.0`** to remediate the bug. The vulnerability was reported by **Nguyen Van Hiep (`@hypnguyen1209`) of MBBank**, and CISA SSVC metadata indicates **no known exploitation** so far, while noting the issue may be **automatable** and carries **total technical impact**.
Jul 21, 2026
A critical security vulnerability, tracked as CVE-2025-49844, has been identified in Redis, an open-source, in-memory database widely used for caching and data storage. The flaw is rated with a CVSS score of 10.0, indicating maximum severity and potential for significant impact. This vulnerability arises from a use-after-free condition in the Lua scripting engine of Redis, which can be exploited by an authenticated user. By crafting a malicious Lua script, an attacker can manipulate the garbage collector within Redis, triggering the use-after-free bug. Successful exploitation of this flaw allows remote code execution on the affected Redis server, granting attackers the ability to run arbitrary code with the privileges of the Redis process. All Redis versions up to and including 8.2.1 are affected by this vulnerability, as they include the vulnerable Lua scripting functionality. The issue has been addressed in Redis version 8.2.2, which contains the necessary patch to remediate the flaw. As an immediate mitigation for organizations unable to upgrade, Redis administrators are advised to restrict the execution of Lua scripts by disabling the EVAL and EVALSHA commands through Access Control Lists (ACLs). The vulnerability requires authentication, but in environments where Redis is exposed to untrusted users or where credentials are weak, the risk of exploitation is heightened. Security advisories recommend prompt patching and review of user permissions to minimize exposure. The flaw was publicly disclosed in early October 2025, and security researchers have emphasized the critical nature of the bug due to its potential for remote exploitation. No specific products beyond Redis itself have been listed as affected, but any deployment using vulnerable versions is at risk. The vulnerability has been confirmed to be remotely exploitable, making it a high-priority issue for organizations relying on Redis for critical infrastructure. The security community has highlighted the importance of monitoring for suspicious Lua script activity as an additional detection measure. Redis users are urged to consult official advisories and update their systems as soon as possible to prevent compromise. The disclosure underscores the ongoing risks associated with embedded scripting engines in widely deployed software. Organizations should also review their network exposure and ensure Redis instances are not accessible from untrusted networks. The incident serves as a reminder of the importance of timely patch management and the need for defense-in-depth strategies in database deployments.
Jul 23, 2026