CVE-2025-58186

What it actually does

A vulnerability exists where the number of cookies parsed from an HTTP request is not limited. An attacker can send a request containing a very large quantity of small cookies. While the total size of the HTTP header may remain within server limits, the server will attempt to parse each individual cookie, allocating a memory structure for each one. This leads to unbounded memory allocation, causing resource exhaustion and a denial-of-service condition.

Why it matters to the business

Exploitation of this vulnerability can lead to a denial of service (DoS). An attacker can render the affected service unresponsive or cause it to crash, making it unavailable to legitimate users. This can result in operational disruption, loss of revenue, and damage to the organization's reputation, depending on the criticality of the affected service.

How an attack unfolds

A remote, unauthenticated attacker crafts a single HTTP request. This request's `Cookie` header is populated with an extremely large number of very small, simple cookies, such as 'a=;b=;c=;...'. When the vulnerable Apache Kvrocks server receives this request, its parsing logic begins to process the cookies one by one. For each cookie, it allocates memory for a new data structure. Because there is no limit on the number of cookies, this process continues until the server's available memory is exhausted, causing it to become slow, unresponsive, and eventually crash.

How to fix it

To remediate this vulnerability, upgrade Apache Kvrocks to a version that includes the fix from commit `a71eb42f33f2a1fdb7a13184b5ad7dff0114aa37` or a later stable release. If an immediate upgrade is not feasible, consider using a reverse proxy or Web Application Firewall (WAF) as a compensating control to limit the number of cookies allowed in a single HTTP request before it reaches the Kvrocks instance.

How to confirm the fix worked

To validate the fix, deploy the patched version of Apache Kvrocks in a non-production environment. Send a test HTTP request containing an abnormally large number of cookies (e.g., over 10,000) and monitor the server's memory consumption. A patched system should handle the request gracefully by rejecting it or limiting parsing, without experiencing excessive memory growth. To identify exposure, scan your environment for instances of Apache Kvrocks and check if their version predates the specified fix commit.

Typical attack path

1. The attacker identifies a publicly accessible server running a vulnerable version of Apache Kvrocks.
2. The attacker crafts a malicious HTTP request containing a `Cookie` header with thousands of small, distinct cookies.
3. The attacker sends this single request to the target server.
4. The server's HTTP parser attempts to process all the cookies, leading to excessive memory allocation.
5. The server's memory is exhausted, resulting in a denial-of-service condition that impacts all users.

How to detect it

To detect potential or past exploitation, security teams should monitor server performance metrics for anomalous spikes in memory utilization on hosts running Apache Kvrocks. Review web server access logs and WAF logs for HTTP requests containing an unusually high number of cookies. An indicator of an attack attempt would be a request with a `Cookie` header that is large and contains an excessive number of semicolon (`;`) delimiters, suggesting many small cookies are being sent at once.

What your security team should do

• Immediately identify all instances of Apache Kvrocks in your environment and prioritize patching those that are internet-facing.
• If patching cannot be performed immediately, deploy a Web Application Firewall (WAF) rule to limit the maximum number of cookies per request to a reasonable threshold.
• Configure monitoring and alerting for sudden, unexplained memory usage spikes on servers running Apache Kvrocks.
• Review HTTP access logs for requests with unusually large Cookie headers or a high frequency of semicolons within the cookie value, which could indicate an attack attempt.