CVE-2026-58064: Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation

Q: Which deployments are exposed to this issue?

Apache bRPC servers with the Redis protocol enabled are affected when the service is reachable by untrusted clients. The described attack is remote and targets the Redis-protocol endpoint.

Q: What does an attacker need to send to trigger the resource consumption?

An attacker needs to send long Redis inline-command input without a terminating CRLF. Before the fix, the parser could allocate and copy the growing connection buffer before establishing the command boundary, increasing memory use and CPU copy overhead.

Q: Does redis_max_allocation_size mitigate the vulnerable inline command path?

Not effectively before the fix. The limit applied to RESP bulk strings and arrays, but the inline command parser could allocate based on the current input buffer before that limit was applied.

Q: What can be done if an upgrade cannot be performed immediately?

Restrict access to Redis-protocol bRPC services so they are not reachable by untrusted clients. The available patch changes parsing to enforce redis_max_allocation_size for inline command lines and reject lines exceeding that limit.

Q: How does version 1.18.0 address the problem?

Version 1.18.0 applies redis_max_allocation_size to Redis inline command lines and scans for CRLF before allocating parser arena memory. Inline command lines over the limit are rejected.

Published Oct 21, 2026

Updated

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service.

Root Cause: The Redis inline command parser allocated memory based on the current input buffer size and copied the entire buffer before determining the current inline command boundary. The existing redismaxallocationsize limit was applied to RESP bulk strings and arrays, but not effectively to the inline command path before allocation.

Affected Scenarios: Use Apache bRPC server with Redis protocol enabled and reachable by untrusted clients.

How to Fix: 1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3363 .

Note: The fix applies redismaxallocationsize to Redis inline command lines and scans for CRLF before allocating parser arena memory. Inline command lines exceeding this limit are rejected.

Affected Software

1 affected component

Apache bRPC<1.18.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache bRPC to a version that resolves this vulnerability.
Fixed in 1.18.0

Event History

Oct 21, 2026

CVE Published

via MITRE·11:41 AM

Data Sourced

via MITRE·11:41 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache bRPC servers with the Redis protocol enabled are affected when the service is reachable by untrusted clients. The described attack is remote and targets the Redis-protocol endpoint.

What does an attacker need to send to trigger the resource consumption?

An attacker needs to send long Redis inline-command input without a terminating CRLF. Before the fix, the parser could allocate and copy the growing connection buffer before establishing the command boundary, increasing memory use and CPU copy overhead.

Does redis_max_allocation_size mitigate the vulnerable inline command path?

Not effectively before the fix. The limit applied to RESP bulk strings and arrays, but the inline command parser could allocate based on the current input buffer before that limit was applied.

What can be done if an upgrade cannot be performed immediately?

Restrict access to Redis-protocol bRPC services so they are not reachable by untrusted clients. The available patch changes parsing to enforce redis_max_allocation_size for inline command lines and reject lines exceeding that limit.

How does version 1.18.0 address the problem?

Version 1.18.0 applies redis_max_allocation_size to Redis inline command lines and scans for CRLF before allocating parser arena memory. Inline command lines over the limit are rejected.

CVE-2026-58064: Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to send to trigger the resource consumption?

Does redis_max_allocation_size mitigate the vulnerable inline command path?

What can be done if an upgrade cannot be performed immediately?

How does version 1.18.0 address the problem?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to send to trigger the resource consumption?

Does redis_max_allocation_size mitigate the vulnerable inline command path?

What can be done if an upgrade cannot be performed immediately?

How does version 1.18.0 address the problem?