CVE-2026-58064
Received Received - Intake

Memory Exhaustion in Apache bRPC Redis Protocol

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: Apache Software Foundation

Description
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service. Root Cause: The Redis inline command parser allocated memory based on the current input buffer size and copied the entire buffer before determining the current inline command boundary. The existing redis_max_allocation_size limit was applied to RESP bulk strings and arrays, but not effectively to the inline command path before allocation. Affected Scenarios: Use Apache bRPC server with Redis protocol enabled and reachable by untrusted clients. How to Fix: 1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue. 2. Apply the patch from PR https://github.com/apache/brpc/pull/3363 . Note: The fix applies redis_max_allocation_size to Redis inline command lines and scans for CRLF before allocating parser arena memory. Inline command lines exceeding this limit are rejected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-10-21
AI Q&A
2026-10-21
EPSS Evaluated
N/A
NVD
CVE-2026-58064
EUVD
EUVD-2026-107175

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache bRPC 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in Apache bRPC involves the Redis protocol implementation incorrectly parsing inline commands. It allocates and copies the entire connection buffer before verifying if a complete CRLF-terminated command is present. This allows attackers to send long inputs without a CRLF, consuming excessive memory and CPU, leading to potential denial of service.

Detection Guidance

This vulnerability can be detected by monitoring for unusual memory or CPU usage spikes on systems running Apache bRPC with Redis protocol enabled. Check for long-running connections without proper CRLF termination in Redis protocol traffic.

Impact Analysis

If you run an Apache bRPC server with Redis protocol enabled and accessible to untrusted clients, attackers could exploit this flaw to consume server resources. This may cause service slowdowns or crashes, disrupting normal operations and availability.

Mitigation Strategies
  • Upgrade Apache bRPC to version 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3363.
  • Ensure redis_max_allocation_size is properly configured to limit inline command sizes.
  • Restrict access to bRPC services to trusted clients only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58064. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart