{"id":"CVE-2026-54426","kind":"vulnerability","aliases":["CVE-2026-54426"],"related":[],"title":"Apache bRPC: deeply nested Redis reply crashes the client process","description":"Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit. \n\nAffected Scenarios:\nApplications using bRPC as a Redis client with ChannelOptions.protocol=\"redis\" and receiving replies from an untrusted or faulty Redis server peer.\n\nHow to Fix:\n1. Upgrade Apache bRPC to 1.18.0.\n2. Apply the patch from PR  https://github.com/apache/brpc/pull/3344 .\n\nNote:\nAfter applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected.","summary":"Apache bRPC's Redis reply parser recurses once per nested array level with no depth limit. A malicious or faulty Redis server can send a deeply nested RESP array reply and crash the bRPC client process.","severity":"medium","cvss":null,"epss":0.00159,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brpc","c++","package","redis","self-hosted"],"not_affected_if":["no-redis-client","trusted-redis-server"],"how_to_check":"- Check the bRPC version in use; affected versions are below `1.18.0`.\n- Search application code for `ChannelOptions.protocol=\"redis\"` to find bRPC Redis clients.","fix":"- Upgrade Apache bRPC to `1.18.0`.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3344.","status":"open","published_at":"2026-10-21T12:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:51+00:00","updated_at":"2026-10-25T05:02:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:02:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0`.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3344.","reach":"network","title":"Apache bRPC: deeply nested Redis reply crashes the client process","impact":"low","summary":"Apache bRPC's Redis reply parser recurses once per nested array level with no depth limit. A malicious or faulty Redis server can send a deeply nested RESP array reply and crash the bRPC client process.","category":"package","nicknames":[],"who_cares":["brpc","c++","redis","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Client process crashes when a malicious Redis server sends a deeply nested reply","analyst_note":"","how_to_check":"- Check the bRPC version in use; affected versions are below `1.18.0`.\n- Search application code for `ChannelOptions.protocol=\"redis\"` to find bRPC Redis clients.","needs_analyst":false,"not_affected_if":["no-redis-client","trusted-redis-server"],"who_is_affected":"Applications that use bRPC as a Redis client with the redis protocol enabled and that receive replies from a Redis server they do not fully trust, or from a faulty server. The risk is a process crash (denial of service), not code execution. Services that only talk to a trusted, controlled Redis instance are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3568,"output_tokens":527,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54426':13A,16A '/apache/brpc/pull/3344':165C '1':151C '1.18.0':70C,156C '128':118C '2':157C 'add':108C 'affect':125C 'allow':71C 'apach':1A,24B,68C,153C 'appli':158C,168C 'applic':127C 'array':34B,52B,90C,99C,174C 'brpc':2A,17B,25B,57B,69C,80C,129C,154C 'c':18B 'channeloptions.protocol':135C 'client':9A,58B,82C,133C 'configur':110C 'crash':7A,55B,78C 'cve':11A,14A 'deeper':176C 'deepli':3A,49B,87C 'default':116C 'depth':38B,104C,113C,181C 'enforc':102C 'exceed':122C 'faulti':43B,144C 'fix':107C,150C,170C 'github.com':164C 'github.com/apache/brpc/pull/3344':163C 'host':23B 'level':35B,100C 'limit':39B,105C,114C,124C 'malici':41B 'max':179C 'nest':4A,33B,50B,88C,98C,175C 'note':166C 'packag':19B 'parser':29B,66C,93C 'patch':160C 'peer':76C,147C 'per':32B 'pr':162C 'process':10A,59B,83C 'receiv':138C 'recurs':30B,61C,94C 'redi':5A,20B,27B,44B,64C,74C,81C,111C,132C,136C,145C,171C,178C 'reject':120C,183C 'remot':73C 'repli':6A,28B,53B,65C,91C,112C,121C,139C,172C,180C 'resp':51B,89C 'return':85C 'scenario':126C 'self':22B 'self-host':21B 'send':47B 'server':45B,75C,146C 'uncontrol':60C 'untrust':142C 'upgrad':152C 'use':128C 'valu':117C 'without':101C","nicknames":[],"mitigations":[],"who_affected":"Applications that use bRPC as a Redis client with the redis protocol enabled and that receive replies from a Redis server they do not fully trust, or from a faulty server. The risk is a process crash (denial of service), not code execution. Services that only talk to a trusted, controlled Redis instance are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54426","severity":null,"published_at":"2026-10-21T12:17:21+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-54426","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54426","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}