[oss-security] CVE-2026-46751: Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.

[Hulk Lin]

Severity: 

Affected versions:

- Apache Kvrocks (apache/kvrocks) 2.2.0 through 2.15.0

Description:

A vulnerability in Apache Kvrocks.

This issue affects Apache Kvrocks: from 2.2.0 through 2.15.0.

Users are recommended to upgrade to version 2.16.0, which fixes the issue.

Credit:

4ra2n (A code security AI agent) (finder)

References:

https://kvrocks.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-46751