CVE-2026-54426: Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser

Q: Which deployments are exposed to this issue?

Applications are affected when they use Apache bRPC as a Redis client with ChannelOptions.protocol set to "redis" and accept replies from an untrusted or faulty Redis server peer. The issue affects bRPC versions earlier than 1.18.0.

Q: What must an attacker or malicious peer do to trigger the crash?

The peer must return a RESP reply containing deeply nested arrays. Before the fix, the parser recurses once per nested array level without a depth limit, which can exhaust the client process stack.

Q: Is a depth limit enabled after updating?

Yes. The fix introduces the configurable redis_max_reply_depth setting, which defaults to 128. Replies whose array nesting exceeds that limit are rejected.

Q: What can be done if upgrading is not immediately possible?

Apply the patch from PR 3344. Until the fix is deployed, avoid accepting Redis replies from untrusted server peers where possible.

Published Oct 21, 2026

Updated

Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit.

Affected Scenarios: Applications using bRPC as a Redis client with ChannelOptions.protocol="redis" and receiving replies from an untrusted or faulty Redis server peer.

How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 .

Note: After applying the fix, Redis replies with array nesting deeper than redismaxreplydepth are rejected.

Affected Software

1 affected component

Apache bRPC<1.18.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache bRPC to a version that resolves this vulnerability.
Fixed in 1.18.0

Event History

Oct 21, 2026

CVE Published

via MITRE·11:32 AM

Data Sourced

via MITRE·11:32 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications are affected when they use Apache bRPC as a Redis client with ChannelOptions.protocol set to "redis" and accept replies from an untrusted or faulty Redis server peer. The issue affects bRPC versions earlier than 1.18.0.

What must an attacker or malicious peer do to trigger the crash?

The peer must return a RESP reply containing deeply nested arrays. Before the fix, the parser recurses once per nested array level without a depth limit, which can exhaust the client process stack.

Is a depth limit enabled after updating?

Yes. The fix introduces the configurable redis_max_reply_depth setting, which defaults to 128. Replies whose array nesting exceeds that limit are rejected.

What can be done if upgrading is not immediately possible?

Apply the patch from PR 3344. Until the fix is deployed, avoid accepting Redis replies from untrusted server peers where possible.

CVE-2026-54426: Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker or malicious peer do to trigger the crash?

Is a depth limit enabled after updating?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker or malicious peer do to trigger the crash?

Is a depth limit enabled after updating?

What can be done if upgrading is not immediately possible?