Uncontrolled Recursion Vulnerability in Apache bRPC Redis Client

CVE-2026-54426

What is CVE-2026-54426?

The vulnerability in Apache bRPC involves an uncontrolled recursion issue within the Redis reply parser, which can lead to application crashes when handling deeply nested RESP array replies from a remote Redis server. The existing parser does not impose a limit on recursion depth, allowing potentially malicious or faulty Redis servers to exploit this weakness. To mitigate this vulnerability, a configurable depth limit for Redis replies has been introduced, with a default setting of 128. Developers are advised to upgrade to Apache bRPC version 1.18.0 or later and apply the relevant patch to prevent excessive array nesting from leading to application failures.

References