Read the docs
TI-2026-78548 Aliases CVE-2026-54426GHSA-m7v5-m3p2-6w26

Uncontrolled recursion in Apache bRPC Redis reply parser

Priority LOW 39CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-674.

Summary

Apache bRPC before 1.18.0 contains uncontrolled recursion (CWE-674) in its Redis reply parser. The parser recurses once for each nested array level without enforcing a depth limit. A remote Redis server peer that returns a deeply nested RESP array reply can crash a bRPC Redis client process. The attacker needs no privileges or user interaction, only an untrusted or faulty Redis server that the client connects to.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit.  Affected Scenarios: Applications using bRPC as a Redis client with ChannelOptions.protocol="redis" and receiving replies from an untrusted or faulty Redis server peer. How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 . Note: After applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00462 40th percentileScored 2026-11-07
Fix Fixed Apache bRPC (Apache Software Foundation): 1.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache bRPCbefore 1.18.01.18.0Patch availableCNA
  • Apache bRPC VendorApache Affected before 1.18.0 Fixed in 1.18.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*——Apache
  • cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:* Versions — — ·Apache

Remediation

Upgrade Apache bRPC to 1.18.0, or apply the patch from pull request 3344 in the apache/brpc repository. After the fix, Redis replies nested deeper than redis_max_reply_depth, which defaults to 128, are rejected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Apache bRPC (Apache Software Foundation) Fixed in 1.18.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache bRPC — lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

    35 records Highest priority Priority MEDIUM 18 MEDIUM, 17 LOW

    Other records, highest priority first

    • TI-2026-78552 Out-of-bounds write in Apache bRPC Redis command parserPriority MEDIUM 49
    • TI-2026-78757 Authentication bypass in Apache bRPC servers using internal_portPriority MEDIUM 48
    • TI-2026-78742 Missing authentication in Apache bRPC streaming RPC framesPriority MEDIUM 48
    Show all 35 records → Advisory →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-54426
  2. 2026-10-21 Alias added: GHSA-m7v5-m3p2-6w26
  3. 2026-10-30 CVSS score added · CISA ADP
  4. 2026-10-30 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences