Apache bRPC: Out-of-bounds write in Redis command parser
Summary
Apache bRPC accepts an empty RESP array as a Redis command header, which leads to an out-of-bounds write in the command parser. An unauthenticated remote attacker who can reach a bRPC server with the Redis service enabled can crash the process, causing a denial of service. The parser runs before authentication, so no credentials are needed. Code execution has not been confirmed.
Affected
- Apache bRPC versions before 1.18.0
- Only deployments that enable ServerOptions.redis_service and accept Redis protocol traffic from untrusted clients
- The default configuration is unaffected
Fixed in
- Apache bRPC 1.18.0 (release notes list fix #3354)
- Patch: https://github.com/apache/brpc/pull/3354 (for builds from source)
Workaround
- No vendor-published workaround. Unconfirmed inference: if redis_service is not set, the Redis parser should not be reachable.
- Restricting access to the Redis port with firewall rules or network segmentation reduces exposure. Test before relying on it.
Exploitation
- Exploitation: none known according to CISA SSVC (exploitation: none, automatable: yes).
- Not listed in CISA KEV. No public proof of concept found; this does not prove none exists.
Our recommendation
- Inventory bRPC-based software and dependencies (lockfiles, SBOMs) and check for redis_service in configuration or code.
- Upgrade to bRPC 1.18.0 or later, or apply PR #3354 if you build from source.
- Block untrusted access to the Redis port until patched.
- Treat internet-reachable bRPC Redis ports as high priority.
- Monitor for unexpected bRPC process crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache bRPC 1.18.0 release notes github.com
- OpenCVE record app.opencve.io
- Apache mailing list thread lists.apache.org
- Strix CVE page www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:37.
Original description (NVD)
The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process. Root Cause: RedisCommandParser::ConsumeImpl rejected negative RESP array counts but accepted zero. It resized the command argument vector to zero elements and continued parsing. When a following bulk string was parsed, the only index guard was a CHECK. In configurations where fatal logs do not abort immediately, execution could continue and write to _args[0] even though the vector was empty. Affected Scenarios: Deployments that enable ServerOptions.redis_service and accept Redis protocol traffic from untrusted clients. The issue is reached during parsing before command handling or authentication. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3354 Note: The fix rejects empty RESP arrays as invalid Redis commands and replaces the internal index CHECK with an explicit parse error so malformed command streams cannot fall through to an indexed vector write.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.