CVE-2026-54426 Details
Description
Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit. Affected Scenarios: Applications using bRPC as a Redis client with ChannelOptions.protocol="redis" and receiving replies from an untrusted or faulty Redis server peer. How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 . Note: After applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected.
A denial-of-service vulnerability has been identified in the Redis reply parser of Apache bRPC versions prior to 1.18.0. This vulnerability allows a remote Redis server to crash a bRPC Redis client process by sending a deeply nested RESP array reply. The parser recursively processed each level of nesting without enforcing a depth limit, leading to stack exhaustion. The issue affects applications using bRPC as a Redis client, with ChannelOptions.protocol set to 'redis', and receiving replies from an untrusted or faulty Redis server.
Users are advised to upgrade Apache bRPC to version 1.18.0 or later. After upgrading, Redis replies with array nesting deeper than the configured maximum depth are rejected. The default maximum depth is 128, but this can be adjusted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb | [email protected] | AdvisoryBundleMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache bRPC | < 1.18.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | CVE Translated | [email protected] |
| Oct 21, 2026 | New CVE Received | [email protected] |