CVE-2026-54426

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit. Affected Scenarios: Applications using bRPC as a Redis client with ChannelOptions.protocol="redis" and receiving replies from an untrusted or faulty Redis server peer. How to Fix: 1. Upgrade Apache bRPC to 1.18.0. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 . Note: After applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-54426

EUVD

EUVD-2026-107170

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

Uncontrolled recursion in the Redis reply parser in Apache bRPC before version 1.18.0 allows a remote Redis server to crash a bRPC Redis client by sending a deeply nested RESP array reply. The parser recursed without a depth limit, causing stack overflow.

Detection Guidance

This vulnerability can be detected by monitoring for crashes in bRPC Redis client processes or by inspecting Redis server replies for deeply nested RESP arrays. Check bRPC logs for parser errors or segmentation faults related to Redis replies.

Impact Analysis

Applications using bRPC as a Redis client with protocol set to redis and receiving replies from untrusted or faulty Redis servers are vulnerable. A malicious server could crash the client process by sending deeply nested replies.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It primarily affects the stability and availability of bRPC Redis client applications by causing crashes due to uncontrolled recursion in Redis reply parsing. Compliance risks would arise only if the crash leads to service disruptions affecting data processing or availability, which is not specified in the provided context.

Mitigation Strategies

Upgrade Apache bRPC to version 1.18.0 or later to apply the fix.
Apply the patch from PR https://github.com/apache/brpc/pull/3344 if upgrading is not immediately possible.
Ensure Redis replies are validated to prevent excessive nesting depths.

Hi! I’m here to help you understand CVE-2026-54426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...