CVE-2026-56388: CWE-787 Out-of-bounds Write in Apache Software Foundation Apache bRPC

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. This leads to resizing the command argument vector to zero elements but continuing parsing. When a subsequent bulk string is parsed, the parser writes to an out-of-bounds index in the argument vector, causing a crash. This occurs before command handling or authentication, allowing remote unauthenticated attackers to trigger the issue by sending a crafted empty array header followed by a bulk string. The root cause is that zero-length RESP arrays were accepted, and the internal index check was insufficient to prevent out-of-bounds writes. The issue is fixed in Apache bRPC 1.18.0 by rejecting empty RESP arrays and replacing the index check with an explicit parse error.

A remote unauthenticated attacker can cause an out-of-bounds write in the Redis command parser, leading to a crash of the bRPC process. This results in denial of service for affected deployments that enable the Redis service and accept Redis protocol traffic from untrusted clients. There is no indication of code execution or data corruption beyond the crash.

Upgrade Apache bRPC to version 1.18.0 or later, which includes the fix rejecting empty RESP arrays and preventing out-of-bounds writes. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3354. Until patched, restrict access to the Redis service to trusted clients to prevent exploitation.