Apache bRPC CVE-2026-56388

The bRPC server must have ServerOptions.redis_service enabled and must accept Redis protocol traffic from untrusted clients - this is an opt-in, non-default deployment mode. The out-of-bounds write is additionally gated by a build/runtime configuration in which fatal CHECK logs do not abort the process immediately; in default configurations the CHECK would abort before the indexed write, limiting the outcome. The vulnerable code path is reached during RESP parsing before command handling or authentication, so no credentials or user interaction are required, but the two configuration prerequisites (Redis service enabled; non-aborting fatal logs) are the primary real-world limiters on exploitation.

No CVSS score is provided by NVD or the vendor, so severity is self-assessed from the description (see assessed vectors). The flaw is a CWE-787 out-of-bounds write in bRPC's Redis RESP command parser reachable pre-authentication, which maps to a network-reachable, unauthenticated condition - a genuinely attractive profile. However, the practical impact described is a process crash (denial of service), not demonstrated code execution: the stray write targets _args[0] of a zero-length vector, and the vendor frames the outcome as 'crashing the process.' No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or probable exploitation - this is currently a theoretical/vendor-reported issue rather than a confirmed in-the-wild priority. Crucially, exploitation is gated by a non-default server configuration (ServerOptions.redis_service enabled and accepting untrusted Redis traffic) AND by a build/log configuration where fatal CHECK logs do not abort immediately; the vendor notes that in default builds the CHECK would normally abort before the OOB write. This conditional dependency substantially narrows real-world risk despite the unauthenticated network reachability. Verify with the vendor whether any shipping configuration leaves the fatal-log abort disabled, since that determines whether the impact is a clean crash versus a potential memory-corruption primitive.

An attacker who can reach a bRPC server that has the Redis service enabled opens a TCP connection and sends a RESP command header declaring an empty array (zero elements) followed by a bulk string. The parser resizes the argument vector to zero but continues parsing the bulk string, writing to _args[0] out of bounds and crashing the service. No public exploit code is identified at time of analysis, and the attack requires no authentication because parsing occurs before command handling or auth.