CVE-2026-58064None▾ SunlitThe Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bR…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service.
Root Cause: The Redis inline command parser allocated memory based on the current input buffer size and copied the entire buffer before determining the current inline command boundary. The existing redis_max_allocation_size limit was applied to RESP bulk strings and arrays, but not effectively to the inline command path before allocation.
Affected Scenarios: Use Apache bRPC server with Redis protocol enabled and reachable by untrusted clients.
How to Fix:
Note: The fix applies redis_max_allocation_size to Redis inline command lines and scans for CRLF before allocating parser arena memory. Inline command lines exceeding this limit are rejected.
apache/brpc < 1.18.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56387NoneApache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
CVE-2026-74757NoneApache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
CVE-2026-78066NoneApache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
CVE-2026-80463NoneApache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
CVE-2026-56388NoneApache bRPC: Out-of-Bounds Write in Redis Command Parser
CVE-2026-56386High· 7.5Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser