Memory Allocation Flaw in Apache bRPC Redis Protocol Parser

CVE-2025-54472

What is CVE-2025-54472?

A memory allocation flaw exists in the Redis protocol parser of Apache bRPC affecting all versions prior to 1.14.1. Attackers can exploit this vulnerability by sending specially crafted data packets to the bRPC service, which may lead to service crashes through malfunctioning memory allocation. Although version 1.14.0 attempted to address this issue by imposing limits on memory allocation, its implementation is weak and can be bypassed, keeping it vulnerable. Users should ensure they either upgrade to version 1.14.1 or apply an available patch to mitigate this risk.

References