Threats tagged 'ghsa-m7v5-m3p2-6w26'

Apache bRPC versions prior to 1.18.0 contain an uncontrolled recursion vulnerability in the Redis reply parser. A remote Redis server peer can send a deeply nested RESP array reply that causes the bRPC Redis client process to crash due to unbounded recursion depth. The issue affects applications using bRPC as a Redis client with ChannelOptions.protocol="redis" when communicating with untrusted or faulty Redis servers. The vulnerability is fixed in version 1.18.0 by introducing a configurable maximum reply depth limit, defaulting to 128, which rejects replies exceeding this limit.