TI-2025-18738 Aliases CVE-2025-25069 GHSA-fp9p-7hx8-xfp3

Apache Kvrocks: Cross-Protocol Scripting Vulnerability

LOW 36CWE-115Published 2025-02-07 · Updated 2025-02-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when it is chained with SSRF. It is similiar to CVE-2016-10517 in Redis. This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0. Users are recommended to upgrade to version 2.11.1, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00806 57th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Kvrocks	up to 2.11.0	—	No fix listed	CNA

Apache Kvrocks VendorApache Affected up to 2.11.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:kvrocks::::::::	before 2.11.1	Vulnerable	Apache

cpe:2.3:a:apache:kvrocks:*:*:*:*:*:*:*:* Versions before 2.11.1 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-25069
2026-10-03 Alias added: GHSA-fp9p-7hx8-xfp3

References

Advisory 1

https://lists.apache.org/thread/gbxv9gpsskmdzg6z48zm3tvo8cyo9v3t

Other 1

https://www.cve.org/CVERecord?id=CVE-2016-10517

TI-2025-19370 Apache Kvrocks: The server was crashed by the negative offset CVSS 3.1HIGH 7.5
TI-2025-37241 Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins CVSS 3.1MEDIUM 5.3
TI-2025-37240 Apache Kvrocks: RESET command grants admin privileges CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences