Out-of-bounds Write Vulnerability in Apache bRPC with Redis Service Enabled

CVE-2026-56388

What is CVE-2026-56388?

The Redis command parser within Apache bRPC is susceptible to an out-of-bounds write due to improper handling of empty RESP arrays in command headers. This vulnerability allows a remote unauthenticated attacker to exploit the parser by sending an empty array header followed by a bulk string. If successful, this can lead to a crash of the bRPC server process. The issue arises from the command parser accepting zero element array sizes without adequate checks, allowing it to resize the command argument vector incorrectly. Environments where the Redis service is enabled and accepting traffic from untrusted clients are particularly at risk. To mitigate this vulnerability, it is essential to upgrade to bRPC version 1.18.0 or apply the suggested patch, which implements stricter validations for RESP arrays.

References