CVE-2026-58064: CWE-770 Allocation of Resources Without Limits or Throttling in Apache Software Foundation Apache bRPC

The Redis protocol implementation in Apache bRPC improperly handles inline command parsing by allocating memory based on the current input buffer size and copying the entire buffer before detecting the command boundary marked by CRLF. While the redis_max_allocation_size limit was enforced for RESP bulk strings and arrays, it was not applied to inline command parsing, allowing an attacker to send excessively long inline commands without CRLF termination. This results in unbounded memory allocation and CPU overhead, which can be exploited by a remote attacker with access to the Redis-protocol bRPC service to cause denial of service. The vulnerability affects Apache bRPC versions >=0 and <1.18.0. The fix in version 1.18.0 enforces redis_max_allocation_size on inline commands and rejects commands exceeding this limit by scanning for CRLF before memory allocation.

A remote attacker with access to a Redis-protocol enabled Apache bRPC server can exploit this vulnerability by sending long inline commands without CRLF termination, causing excessive memory allocation and CPU usage. This can lead to denial of service conditions on the affected server due to resource exhaustion.

Upgrade Apache bRPC to version 1.18.0 or later, which includes the fix for this vulnerability. The fix enforces the redis_max_allocation_size limit on inline Redis commands and rejects commands exceeding this limit before allocating memory. Applying the patch from PR https://github.com/apache/brpc/pull/3363 also addresses the issue. No other mitigations are indicated by the vendor advisory.