Live › vulnerability › CVE-2026-54426
Go to dashboardApache bRPC's Redis reply parser recurses once per nested array level with no depth limit. A malicious or faulty Redis server can send a deeply nested RESP array reply and crash the bRPC client process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use bRPC as a Redis client with the redis protocol enabled and that receive replies from a Redis server they do not fully trust, or from a faulty server. The risk is a process crash (denial of service), not code execution. Services that only talk to a trusted, controlled Redis instance are less exposed.
No product ranges from the sources yet.
1.18.0.ChannelOptions.protocol="redis" to find bRPC Redis clients.1.18.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit.
Affected Scenarios: Applications using bRPC as a Redis client with ChannelOptions.protocol="redis" and receiving replies from an untrusted or faulty Redis server peer.
How to Fix:
Note: After applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected.
This page as .md · .json · in your agent: get_signal("CVE-2026-54426")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.