CVE-2026-54426

{
  "id": "CVE-2026-54426",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-21T12:17:21.180",
  "lastModified": "2026-10-30T14:17:06.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and rejects replies exceeding that limit. \n\nAffected Scenarios:\nApplications using bRPC as a Redis client with ChannelOptions.protocol=\"redis\" and receiving replies from an untrusted or faulty Redis server peer.\n\nHow to Fix:\n1. Upgrade Apache bRPC to 1.18.0.\n2. Apply the patch from PR  https://github.com/apache/brpc/pull/3344 .\n\nNote:\nAfter applying the fix, Redis replies with array nesting deeper than redis_max_reply_depth are rejected."
    },
    {
      "lang": "es",
      "value": "Recursión no controlada en el analizador de respuestas de Redis en Apache bRPC versiones anteriores a 1.18.0 permite que un servidor Redis remoto haga que el proceso cliente bRPC Redis se bloquee al devolver una respuesta de matriz RESP profundamente anidada. El analizador recursiona una vez por cada nivel de matriz anidada sin imponer un límite de profundidad. La corrección añade un límite configurable de profundidad de respuesta Redis con valor predeterminado 128 y rechaza respuestas que superen ese límite.\\n\\nEscenarios afectados:\\nAplicaciones que usan bRPC como cliente Redis con ChannelOptions.protocol=\\“redis\\” y reciben respuestas de un servidor Redis no confiable o defectuoso.\\n\\nCómo corregir:\\n1. Actualizar Apache bRPC a la versión 1.18.0.  \\n2. Aplicar el parche del PR https://github.com/apache/brpc/pull/3344.\\n\\nNota:\\nDespués de aplicar la corrección, las respuestas Redis con anidamiento de matrices superior a redis_max_reply_depth son rechazadas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache bRPC",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.18.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-30T13:46:36.006598Z",
          "id": "CVE-2026-54426",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb",
      "source": "[email protected]"
    }
  ]
}