A remote denial‑of‑service flaw arises when a malicious user triggers an integer overflow during the RESTORE IntSet command in Apache Kvrocks. The overflow corrupts internal data structures, causing the server process to crash. This vulnerability can be leveraged by an attacker sending a crafted payload over the network without needing any special privileges, leading to an interruption of service for all clients. The issue is tied to a classic integer‑overflow weakness.

Apache Kvrocks versions from 2.6.0 through 2.15.0 are affected. The vendor recommends moving to version 2.16.0 to apply the fix.

The CVSS score of 6.4 indicates a moderate severity. EPSS data is not available, so the current exploitation probability is unknown; however, since the flaw is remote and does not require authentication, it remains a valid threat vector. The vulnerability is not listed in the CISA KEV catalog, but any exposed Kvrocks instance remains vulnerable until patched.