Advisory [CVE-2026-58064] The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available.

A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service.

Root Cause: The Redis inline command parser allocated memory based on the current input buffer size and copied the entire buffer before determining the current inline command boundary.

The existing redis_max_allocation_size limit was applied to RESP bulk strings and arrays, but not effectively to the inline command path before allocation.

Affected Scenarios: Use Apache bRPC server with Redis protocol enabled and reachable by untrusted clients.

How to Fix: 1.

Upgrade Apache bRPC to version 1.18.0, which fixes this issue. 2.

Apply the patch from PR.

Note: The fix applies redis_max_allocation_size to Redis inline command lines and scans for CRLF before allocating parser arena memory.

Inline command lines exceeding this limit are rejected.