Denial of Service Vulnerability in Apache bRPC with Redis Protocol

CVE-2026-58064

What is CVE-2026-58064?

A vulnerability in the Redis protocol implementation of Apache bRPC allows remote attackers to exploit the inline command parsing mechanism. The issue arises from the protocol's handling of command input, leading to excessive memory usage and increased CPU overhead when processing long inline commands without proper termination. This condition can result in denial of service when an untrusted client connects to a Redis-protocol-enabled bRPC service. The fix is to upgrade Apache bRPC to version 1.18.0 or apply the relevant patch to ensure that memory allocation is secured against such exploitation.

References