All vulnerabilities
CVE-2026-54426

Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser

Apache Software Foundation Apache bRPCFrameworks
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.18.0Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit.

Affected Scenarios: Applications using bRPC as a Redis client with ChannelOptions.protocol="redis" and receiving replies from an untrusted or faulty Redis server peer.

How to Fix:

  1. Upgrade Apache bRPC to 1.18.0.
  2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 .

Note: After applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected.

Text from CVE List

Affected versions 1

  • Apache bRPCaffected: all versions before 1.18.0CVE List

References 1