Apache bRPC CVE-2026-58064

Requires an Apache bRPC server with the Redis protocol handler enabled (non-default protocol selection) and that endpoint reachable by untrusted/attacker-controlled clients. The specific trigger is a long inline (non-RESP-bulk) command sent without a terminating CRLF, exploiting that the pre-fix redis_max_allocation_size limit was enforced on RESP bulk strings/arrays but NOT on the inline command path before allocation. Limiting factors: exploitation is impossible if the Redis protocol is not enabled or the service is not exposed to untrusted networks, and impact is confined to resource exhaustion (DoS) with no code execution or data disclosure; upgrading to bRPC 1.18.0 (or applying PR #3363) applies the allocation limit and CRLF scan to inline lines, rejecting oversized inputs.

This is a CWE-770 uncontrolled resource consumption (memory/CPU) denial-of-service flaw in Apache bRPC's Redis-protocol inline command parser. No CVSS score or vector is provided in the input, and there is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis - so the only severity signal is the description itself, which characterizes impact as 'potentially causing denial of service' (availability-only, no confidentiality or integrity loss). Based on the description, the attack vector is network-facing against a bRPC service with the Redis protocol enabled, and no authentication or user interaction appears necessary, but note the precision caveat: no vendor CVSS vector is supplied, so authentication requirements are not confirmed from available data and are only inferred from the 'reachable by untrusted clients' language. Real-world priority should be treated as MODERATE-and-conditional rather than critical: the impact ceiling is DoS only (not RCE/data exposure), exploitation is gated on the non-default condition of exposing a Redis-protocol bRPC endpoint to untrusted networks, and there is no evidence of exploitation or weaponization. For most deployments this is a patch-in-normal-cycle issue; it rises in priority only where a bRPC Redis endpoint is directly internet- or tenant-exposed. Key missing data: no official CVSS, no EPSS, no POC/KEV status - all of which limits confidence in any quantitative risk ranking.

An attacker who can reach a bRPC server running the Redis protocol opens a connection and sends a very long inline command line while deliberately omitting the terminating CRLF. The parser repeatedly allocates and copies the entire growing connection buffer before a command boundary is found, driving up memory usage and CPU copy overhead and degrading or denying service. No public exploit code has been identified at time of analysis, and the attack requires only a reachable Redis-protocol endpoint.