CVE-2026-56388: Apache bRPC: Out-of-Bounds Write in Redis Command Parser
The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process.
Root Cause: RedisCommandParser::ConsumeImpl rejected negative RESP array counts but accepted zero. It resized the command argument vector to zero elements and continued parsing. When a following bulk string was parsed, the only index guard was a CHECK. In configurations where fatal logs do not abort immediately, execution could continue and write to args[0] even though the vector was empty.
Affected Scenarios: Deployments that enable ServerOptions.redisservice and accept Redis protocol traffic from untrusted clients. The issue is reached during parsing before command handling or authentication.
How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3354
Note: The fix rejects empty RESP arrays as invalid Redis commands and replaces the internal index CHECK with an explicit parse error so malformed command streams cannot fall through to an indexed vector write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when ServerOptions.redis_service is enabled and the bRPC server accepts Redis protocol traffic from untrusted clients. The flaw is triggered during parsing, before command handling or authentication.
What does an attacker need to exploit it?
An unauthenticated remote attacker needs network reachability to a bRPC server with Redis service enabled. They can send an empty RESP array header followed by a bulk string to trigger the parser condition.
What is the impact of successful exploitation?
The malformed Redis input can cause an out-of-bounds write and crash the bRPC process. The out-of-bounds write can occur if fatal logging is configured not to abort execution immediately.
What should be done if the service cannot be upgraded immediately?
Apply the referenced patch, which rejects empty RESP arrays and returns an explicit parse error for malformed input. Restrict Redis protocol access from untrusted clients where possible.