Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
Summary
| CVE | CVE-2026-54426 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-21 12:17:21 UTC |
| Updated | 2026-10-26 21:10:00 UTC |
| Description | Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit. Affected Scenarios: Applications using bRPC as a Redis client with ChannelOptions.protocol="redis" and receiving replies from an untrusted or faulty Redis server peer. How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 . Note: After applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected. |
Risk And Classification
EPSS: 0.001590000 probability, percentile 0.049620000 (date 2026-10-26)
Problem Types: CWE-674 | CWE-674 CWE-674 Uncontrolled Recursion
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache BRPC | affected 1.18.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb | [email protected] | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Nikko Enggaliano Pratama ([email protected]) on Github (en)
There are currently no legacy QID mappings associated with this CVE.