Analysis Summary

CVE-2025-26413 CVSS:5.3

Apache Kvrocks is vulnerable to a denial of service, caused by the failure to check if the 'offset' input is a positive integer by the SETRANGE command. By using the input as an index of a string and the index being out of range, a remote attacker could cause the server to crash.

CVE-2025-27820 CVSS:7.5

Apache HttpClient could allow a remote attacker to bypass cookie management and host name verification, caused by a flaw in the PSL validation logic.

Impact

• Denial of Service
• Security Bypass

Indicators of Compromise

CVE

• CVE-2025-26413

• CVE-2025-27820

Affected Vendors

Remediation

Upgrade to the latest version, available from the Apache Website.

CVE-2025-26413

CVE-2025-27820