How severe is CVE-2025-25069?

CVE-2025-25069 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-25069 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-25069?

CVE-2025-25069 affects Apache Kvrocks. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-25069?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-25069 have an EU (EUVD) identifier?

Yes. CVE-2025-25069 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-4010.

When was CVE-2025-25069 published?

CVE-2025-25069 was published on 2025-02-07 and last updated on 2026-06-17.

CVE-2025-25069

CVE-2025-25069 is a medium-severity vulnerability in Apache Kvrocks with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-115.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (51st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-4010
Weakness: CWE-115
Affected product: Apache Kvrocks
Published: 2025-02-07
Last modified: 2026-06-17

Description

A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when it is chained with SSRF. It is similiar to CVE-2016-10517 in Redis. This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0. Users are recommended to upgrade to version 2.11.1, which fixes the issue.

Frequently asked questions

What is CVE-2025-25069?: A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when it is chained with SSRF. It is similiar to CVE-2016-10517 in Redis. This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0. Users are recommended to upgrade to version 2.11.1, which fixes the issue.
How severe is CVE-2025-25069?: CVE-2025-25069 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-25069 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-25069?: CVE-2025-25069 affects Apache Kvrocks. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-25069?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-25069 have an EU (EUVD) identifier?: Yes. CVE-2025-25069 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-4010.
When was CVE-2025-25069 published?: CVE-2025-25069 was published on 2025-02-07 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:kvrocks:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Kvrocks

CVE-2025-26413 — High (CVSS 7.5): Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is…
CVE-2025-59790 — Medium (CVSS 5.4): Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through…
CVE-2025-59792 — Medium (CVSS 5.3): Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache…

All CVEs affecting Apache Kvrocks →

Other CWE-115 vulnerabilities

CVE-2020-27846 — Critical (CVSS 9.8): A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML…
CVE-2020-29511 — Critical (CVSS 9.8): The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes…
CVE-2020-29510 — Critical (CVSS 9.8): The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during…
CVE-2020-29509 — Critical (CVSS 9.8): The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes…
CVE-2023-0880 — High (CVSS 8.3): Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
CVE-2025-5747 — High (CVSS 8.0): WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This…

Browse all CWE-115 vulnerabilities →