Skip to content
VulniPulse
Sign in
Advisory severityUnratedApache Software Foundation Updated

Advisory [CVE-2026-54426] Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply

This security Apache Software Foundation advisory covers CVE-2026-54426; related products: Apache bRPC.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-54426 Source published Source updated

VulniPulse record published Record updated

CVE-2026-54426
Related products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit.

The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit.

Affected Scenarios: Applications using bRPC as a Redis client with ChannelOptions.protocol="redis" and receiving replies from an untrusted or faulty Redis server peer.

How to Fix: 1.

Upgrade Apache bRPC to 1.18.0. 2.

Apply the patch from PR.

Note: After applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected.

Affected versions
  • Apache bRPC before 1.18.0

Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source

Fixed versions
  • 1.18.0

Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • The parser recursed once for each nested array level without enforcing a depth limit.
  • The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit.
  • Upgrade Apache bRPC to 1.18.0.
  • Apply the patch from PR https://github.com/apache/brpc/pull/3344.

Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.