GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-25069 (GCVE-0-2025-25069)

Vulnerability from cvelistv5 – Published: 2025-02-07 12:46 – Updated: 2025-02-13 21:21
VLAI
Title
Apache Kvrocks: Cross-Protocol Scripting Vulnerability
Summary
A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when it is chained with SSRF. It is similiar to CVE-2016-10517 in Redis. This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0. Users are recommended to upgrade to version 2.11.1, which fixes the issue.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-13 21:21 UTC
CWE
  • CWE-115 - Misinterpretation of Input
Assigner
References
Impacted products
Vendor Product Version CPE status
Apache Software Foundation Apache Kvrocks Affected: 0 , ≤ 2.11.0 (semver)
guessed Create a notification for this product.
Credits
Sergey Volosatov
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-25069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-13T21:21:35.668189Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-13T21:21:42.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Kvrocks",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.11.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Sergey Volosatov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA Cross-Protocol Scripting vulnerability is found in Apache Kvrocks.\u003c/p\u003eSince Kvrocks didn\u0027t detect if \"Host:\" or \"POST\" appears in RESP requests,\u003cbr\u003ea valid HTTP request can also be sent to Kvrocks as a valid RESP request \u003cbr\u003eand trigger some database operations, which can be\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;dangerous when \u003cbr\u003eit is chained with SSRF.\u003cbr\u003e\u003cbr\u003e\u003c/span\u003eIt is similiar to\u0026nbsp;CVE-2016-10517 in Redis.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.11.1, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks.\n\nSince Kvrocks didn\u0027t detect if \"Host:\" or \"POST\" appears in RESP requests,\na valid HTTP request can also be sent to Kvrocks as a valid RESP request \nand trigger some database operations, which can be\u00a0dangerous when \nit is chained with SSRF.\n\nIt is similiar to\u00a0CVE-2016-10517 in Redis.\n\nThis issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0.\n\nUsers are recommended to upgrade to version 2.11.1, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "Moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-115",
              "description": "CWE-115 Misinterpretation of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-07T12:46:11.350Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-10517"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/gbxv9gpsskmdzg6z48zm3tvo8cyo9v3t"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Kvrocks: Cross-Protocol Scripting Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-25069",
    "datePublished": "2025-02-07T12:46:11.350Z",
    "dateReserved": "2025-02-03T13:33:31.674Z",
    "dateUpdated": "2025-02-13T21:21:42.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-25069",
      "date": "2026-09-16",
      "epss": "0.00806",
      "percentile": "0.55016"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-25069\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2025-02-07T13:15:32.170\",\"lastModified\":\"2026-06-17T09:00:14.600\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks.\\n\\nSince Kvrocks didn\u0027t detect if \\\"Host:\\\" or \\\"POST\\\" appears in RESP requests,\\na valid HTTP request can also be sent to Kvrocks as a valid RESP request \\nand trigger some database operations, which can be\u00a0dangerous when \\nit is chained with SSRF.\\n\\nIt is similiar to\u00a0CVE-2016-10517 in Redis.\\n\\nThis issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0.\\n\\nUsers are recommended to upgrade to version 2.11.1, which fixes the issue.\"},{\"lang\":\"es\",\"value\":\"Se ha detectado una vulnerabilidad de Cross-Protocol Scripting en Apache Kvrocks. Dado que Kvrocks no detecta si aparece \\\"Host:\\\" o \\\"POST\\\" en las solicitudes RESP, tambi\u00e9n se puede enviar una solicitud HTTP v\u00e1lida a Kvrocks como una solicitud RESP v\u00e1lida y activar algunas operaciones de base de datos, lo que puede ser peligroso cuando se encadena con SSRF. Es similar a CVE-2016-10517 en Redis. Este problema afecta a Apache Kvrocks: desde la versi\u00f3n inicial hasta la \u00faltima versi\u00f3n 2.11.0. Se recomienda a los usuarios que actualicen a la versi\u00f3n 2.11.1, que soluciona el problema.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Kvrocks\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"2.11.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-13T21:21:35.668189Z\",\"id\":\"CVE-2025-25069\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-115\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:kvrocks:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.11.1\",\"matchCriteriaId\":\"FA3F1E1E-0969-477C-A732-BC37943EDFE6\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/gbxv9gpsskmdzg6z48zm3tvo8cyo9v3t\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2016-10517\",\"source\":\"security@apache.org\",\"tags\":[\"Not Applicable\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T17:18:16+00:00",
      "cve": "CVE-2025-25069",
      "id": "CVE-2025-25069",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Apache Kvrocks: Cross-Protocol Scripting Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-25069.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-25069\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-13T21:21:35.668189Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-13T21:21:06.456Z\"}}], \"cna\": {\"title\": \"Apache Kvrocks: Cross-Protocol Scripting Vulnerability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Sergey Volosatov\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"Moderate\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Kvrocks\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.11.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.cve.org/CVERecord?id=CVE-2016-10517\", \"tags\": [\"related\"]}, {\"url\": \"https://lists.apache.org/thread/gbxv9gpsskmdzg6z48zm3tvo8cyo9v3t\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks.\\n\\nSince Kvrocks didn\u0027t detect if \\\"Host:\\\" or \\\"POST\\\" appears in RESP requests,\\na valid HTTP request can also be sent to Kvrocks as a valid RESP request \\nand trigger some database operations, which can be\\u00a0dangerous when \\nit is chained with SSRF.\\n\\nIt is similiar to\\u00a0CVE-2016-10517 in Redis.\\n\\nThis issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0.\\n\\nUsers are recommended to upgrade to version 2.11.1, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eA Cross-Protocol Scripting vulnerability is found in Apache Kvrocks.\u003c/p\u003eSince Kvrocks didn\u0027t detect if \\\"Host:\\\" or \\\"POST\\\" appears in RESP requests,\u003cbr\u003ea valid HTTP request can also be sent to Kvrocks as a valid RESP request \u003cbr\u003eand trigger some database operations, which can be\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u0026nbsp;dangerous when \u003cbr\u003eit is chained with SSRF.\u003cbr\u003e\u003cbr\u003e\u003c/span\u003eIt is similiar to\u0026nbsp;CVE-2016-10517 in Redis.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.11.1, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-115\", \"description\": \"CWE-115 Misinterpretation of Input\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2025-02-07T12:46:11.350Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-25069\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-13T21:21:42.342Z\", \"dateReserved\": \"2025-02-03T13:33:31.674Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2025-02-07T12:46:11.350Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.