CVE-2026-58064— Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
Quick assessment
Affected
Apache Software Foundation Apache bRPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache bRPC 中的 Redis 协议实现在解析行内命令时，会在尚未接收到完整的以 CRLF 结尾的命令之前，就预先分配并复制整个连接缓冲区。能够访问启用 Redis 协议的 bRPC 服务的远程攻击者，可以发送不带终止符 CRLF 的超长行内输入，从而大幅增加内存占用和 CPU 复制开销，可能导致拒绝服务（DoS）攻击。 根本原因： Redis 行内命令解析器根据当前输入缓冲区的大小分配内存，并在确定行内命令边界之前复制了整个缓冲区。现有的 限制仅应用于 RESP 大字符串和数组，而未在行内命令路径的内存
Possible ATT&CK Techniques 1 AI
T1499.003 · Application Exhaustion FloodAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache bRPC | < 1.18.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-58064
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
Source: CVE Program / CVE List V5
Vulnerability Description
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service.
Root Cause:
The Redis inline command parser allocated memory based on the current input buffer size and copied the entire buffer before determining the current inline command boundary. The existing redis_max_allocation_size limit was applied to RESP bulk strings and arrays, but not effectively to the inline command path before allocation.
Affected Scenarios:
Use Apache bRPC server with Redis protocol enabled and reachable by untrusted clients.
How to Fix:
1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.
2. Apply the patch from PR https://github.com/apache/brpc/pull/3363 .
Note:
The fix applies redis_max_allocation_size to Redis inline command lines and scans for CRLF before allocating parser arena memory. Inline command lines exceeding this limit are rejected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache bRPC | 0 ~ 1.18.0 | - |
|
II. Public POCs for CVE-2026-58064
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58064
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2026-10-21 · 69 CVEs total
| CVE-2026-105944 | 10.0 CRITICAL | Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Puls |
| CVE-2026-111812 | 10.0 CRITICAL | Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the pr |
| CVE-2026-111813 | 10.0 CRITICAL | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick |
| CVE-2026-111815 | 10.0 CRITICAL | Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT |
| CVE-2026-111814 | 10.0 CRITICAL | Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pool |
| CVE-2026-111809 | 9.3 CRITICAL | Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable r |
| CVE-2026-111816 | 9.3 CRITICAL | Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the |
| CVE-2026-105869 | 9.2 CRITICAL | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for |
| CVE-2026-111811 | 9.0 CRITICAL | Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network w |
| CVE-2025-31699 | 8.9 HIGH | Apache Traffic Server: Origin connection still owed a request body is reused, enabling req |
| CVE-2026-105937 | 8.7 HIGH | Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant messag |
| CVE-2025-55702 | 8.7 HIGH | Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new requ |
| CVE-2026-111808 | 8.6 HIGH | Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend w |
| CVE-2026-111805 | 8.6 HIGH | Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend work |
| CVE-2026-111804 | 8.2 HIGH | Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest met |
| CVE-2026-105945 | 7.7 HIGH | Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package |
| CVE-2026-105942 | 7.7 HIGH | Apache Pulsar: Original principal of proxied requests authorized with the proxy's authenti |
| CVE-2026-111810 | 7.5 HIGH | Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denia |
| CVE-2026-105934 | 7.2 HIGH | Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topi |
| CVE-2026-105930 | 6.0 MEDIUM | Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cro |
Showing top 20 of 69 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache bRPC
-
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser -
CVE-2026-87849
Apache bRPC: Out-of-bounds read via non-object fields in Dis -
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-86147
Apache bRPC: Arbitrary file creation/truncation via /flags a -
CVE-2026-86146
Apache bRPC: HTTP Request Smuggling and Header Injection via
Same vendor: Apache Software Foundation
-
CVE-2026-112381
Apache Traffic Server: Nullptr dereference in net_write_io o -
CVE-2026-111817
Apache Traffic Server: Dropping chunked trailers stalls a pa -
CVE-2026-111812
Apache Traffic Server: origin_server_auth signs client-contr -
CVE-2026-111811
Apache Traffic Server: tsmemcache plugin exposes the shared -
CVE-2026-111809
Apache Traffic Server: HEAD requests carrying Content-Length
Same weakness: CWE-770
-
CVE-2026-113811
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 fo -
CVE-2026-114386
Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit B -
CVE-2026-80463
Apache bRPC: Unbounded Memory Accumulation in Stream Message -
CVE-2026-78066
Apache bRPC: Resource Exhaustion via Unbounded Decompression -
CVE-2026-74757
Apache bRPC: Uncontrolled Memory Allocation via Malicious mc
V. Comments for CVE-2026-58064
No comments yet