Threats tagged 'ghsa-fgf7-x5pv-vcc3'

A vulnerability in Apache bRPC's Redis protocol parser allows attackers to cause unlimited memory allocation leading to service crashes. This affects all versions prior to 1.14.1, including version 1.14.0 due to an incomplete fix. The issue arises from improper handling of integer values read from the network, which can cause integer overflow and excessive memory allocation. This can be exploited to perform denial-of-service attacks when bRPC is used as a Redis server or client with untrusted sources. The issue is fixed in version 1.14.1, and a patch is available to limit memory allocation size with a default maximum of 64MB.