CVE-2026-54426— Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
Quick assessment
Affected
Apache Software Foundation Apache bRPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Apache bRPC 版本低于 1.18.0 时，其 Redis 响应解析器存在不受控的递归问题。攻击者可利用此漏洞，通过向 bRPC Redis 客户端返回深度嵌套的 RESP 数组响应，致使客户端进程崩溃。该解析器在处理每一层嵌套数组时都会触发一次递归调用，且未对嵌套深度施加任何限制。修复方案引入了可配置的 Redis 响应深度限制（默认值为 128），并会拒绝超过该限制的响应。 受影响场景： 使用 bRPC 作为 Redis 客户端，且配置为 ，同时从不可信或存在故障的 Redis 服务器对等端接收响应
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54426
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit.
Affected Scenarios:
Applications using bRPC as a Redis client with ChannelOptions.protocol="redis" and receiving replies from an untrusted or faulty Redis server peer.
How to Fix:
1. Upgrade Apache bRPC to 1.18.0.
2. Apply the patch from PR https://github.com/apache/brpc/pull/3344 .
Note:
After applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache bRPC | 0 ~ 1.18.0 | - |
|
II. Public POCs for CVE-2026-54426
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54426
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2026-10-21 · 39 CVEs total
| CVE-2026-56387 | Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser | |
| CVE-2026-78048 | Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Deco | |
| CVE-2026-74758 | Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling | |
| CVE-2026-74757 | Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count | |
| CVE-2026-74755 | Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service | |
| CVE-2026-66392 | Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names | |
| CVE-2026-61916 | Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms | |
| CVE-2026-61902 | Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits | |
| CVE-2026-58064 | Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation | |
| CVE-2026-56388 | Apache bRPC: Out-of-Bounds Write in Redis Command Parser | |
| CVE-2026-78058 | Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path | |
| CVE-2026-56386 | Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser | |
| CVE-2026-54427 | Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser | |
| CVE-2026-54425 | Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding | |
| CVE-2026-48830 | Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for | |
| CVE-2026-59229 | Apache IoTDB: Legacy Pipe Privilege Escalation | |
| CVE-2026-59562 | Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe send | |
| CVE-2026-41114 | Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JD | |
| CVE-2026-58663 | Apache IoTDB: Auth Bypass in pipeTransfer() interface | |
| CVE-2026-82425 | Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache bRPC
-
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser -
CVE-2026-87849
Apache bRPC: Out-of-bounds read via non-object fields in Dis -
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-86147
Apache bRPC: Arbitrary file creation/truncation via /flags a -
CVE-2026-86146
Apache bRPC: HTTP Request Smuggling and Header Injection via
Same vendor: Apache Software Foundation
-
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser -
CVE-2026-87849
Apache bRPC: Out-of-bounds read via non-object fields in Dis -
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-86147
Apache bRPC: Arbitrary file creation/truncation via /flags a -
CVE-2026-86146
Apache bRPC: HTTP Request Smuggling and Header Injection via
Same weakness: CWE-674
-
CVE-2026-82230
Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcp -
CVE-2026-54427
Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF -
CVE-2026-54425
Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Ta -
CVE-2026-92822
Libmodulemd: libmodulemd: unbounded recursion when parsing n -
CVE-2026-113650
ApostropheCMS sanitize-html: unbounded recursion when re-san
V. Comments for CVE-2026-54426
No comments yet