Threats tagged 'ghsa-m3mv-32pp-6vgx'

Apache bRPC's Redis protocol implementation had a vulnerability in its inline command parsing that allowed a remote attacker to send long inline inputs without a terminating CRLF, causing excessive memory allocation and CPU overhead. This could lead to denial of service by exhausting server resources. The issue was due to the parser allocating memory based on the full input buffer before confirming command boundaries, and the existing memory limit was not applied to inline commands. The vulnerability affects Apache bRPC servers with Redis protocol enabled and accessible by untrusted clients. The issue is fixed in Apache bRPC version 1.18.0.