CVE-2026-46752: Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()

Synopsis

A heap-based buffer overflow exists in the Lua cjson library embedded in Apache Kvrocks, affecting versions 2.0.4 through 2.15.0. The vulnerability is reachable over the network with no authentication required, making it exploitable by any client that can send commands to the Kvrocks service. Successful exploitation gives an attacker full read, write, and availability impact over both the affected service and any systems it can reach. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network (AV:N); an attacker must be able to send commands to the exposed Kvrocks service endpoint.

• AuthenticationNot required

  No credentials or account are needed (PR:N); any unauthenticated client that can reach the service can trigger the overflow.

• Victim interactionNot required

  No user action is needed (UI:N); the attacker triggers the overflow entirely through their own requests to the service.

• Attack complexityDetail

  Attack complexity is low (AC:L); the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• An attacker can read arbitrary memory from the Kvrocks process, exposing stored keys, values, session data, and any secrets held in memory.
• An attacker can write to arbitrary memory locations, modifying persisted data structures and injecting malicious content into the database.
• The affected Kvrocks service can be crashed or rendered unresponsive, causing a full denial of service for dependent applications.
• Because both system confidentiality and system integrity are rated High (SC:H, SI:H, SA:H), compromise extends beyond the Kvrocks process itself to other services or infrastructure sharing the same host or network segment.