Apache Kvrocks allows a user who can run EVAL scripts to load unvalidated Lua bytecode via the unsafe loadstring function in its sandbox. This can crash the server process, causing a denial of service. The vulnerability exists because the sandbox does not properly restrict code execution, and it is exploitable by sending crafted bytecode to the EVAL command. The attack vector is inferred from the description, which states a user with EVAL privileges can inject bytecode. No additional information on the specific prerequisites or required permissions is provided.

Apache Software Foundation’s Apache Kvrocks versions 2.2.0 through 2.15.0 are affected. Users should upgrade to version 2.16.0, which resolves this issue.

The CVSS score of 5.5 indicates a moderate risk, but the potential to bring the service down makes the impact significant for availability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires an authenticated or otherwise privileged ability to run EVAL statements, which is not trivial. Nonetheless, once the vulnerability is triggered, the service will denial of service until restarted.