CVE-2026-54426: CWE-674 Uncontrolled Recursion in Apache Software Foundation Apache bRPC
Description
Apache bRPC versions prior to 1.18.0 contain an uncontrolled recursion vulnerability in the Redis reply parser. This flaw allows a remote Redis server peer to crash a bRPC Redis client by sending a deeply nested RESP array reply, causing the parser to recurse without a depth limit. The issue is fixed in version 1.18.0 by adding a configurable maximum reply depth, defaulting to 128, which rejects overly nested replies.
Affected software
Apache Software Foundation
Apache bRPC
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-54426 describes an uncontrolled recursion vulnerability in Apache bRPC's Redis reply parser for versions before 1.18.0. The parser recurses once per nested array level in RESP replies without enforcing a maximum depth, enabling a remote Redis server peer to crash the client process by sending deeply nested arrays. The fix in version 1.18.0 introduces a configurable depth limit (default 128), rejecting replies exceeding this limit to prevent recursion-related crashes.
Potential Impact
A remote Redis server peer can cause a denial of service by crashing the Apache bRPC Redis client process through deeply nested RESP array replies. This affects applications using bRPC as a Redis client with ChannelOptions.protocol="redis" when communicating with untrusted or faulty Redis servers.
Mitigation Recommendations
Upgrade Apache bRPC to version 1.18.0 or later, which includes a fix adding a configurable maximum Redis reply depth to prevent uncontrolled recursion. Alternatively, apply the patch from PR https://github.com/apache/brpc/pull/3344. After the fix, replies exceeding the configured depth limit are rejected, mitigating the crash risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-06-14T07:05:33.297Z
- State
- PUBLISHED
Threat ID: 6ad8a6b62cdf04f656e813e2
Added to database: 10/21/2026, 11:49:10 UTC
Last enriched: 10/21/2026, 12:03:53 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.