Apache bRPC Vulnerability Allows Attackers to Crash the Service via Network
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A severe vulnerability in Apache bRPC has been discovered that allows attackers to crash services through network exploitation, affecting all versions prior to 1.14.1.\u00a0<\/p>\n
The vulnerability, identified as CVE-2025-54472 with \u201cimportant\u201d severity classification, stems from unlimited memory allocation in the Redis protocol parser component.<\/p>\n
Key Takeaways<\/mark><\/strong>
1. Apache bRPC versions before 1.14.1 have a Redis parser vulnerability.
2.\u00a0 Attackers send crafted packets with large integers to trigger memory allocation failures.
3. Upgrade or apply GitHub patch.<\/pre>\nApache bRPC Vulnerability<\/strong><\/h2>\n
The root cause of this vulnerability lies in the bRPC Redis protocol parser\u2019s handling of network data.\u00a0<\/p>\n
When processing Redis protocol<\/a> messages, the parser allocates memory for arrays or strings based on integer values read directly from network packets without proper validation.\u00a0<\/p>\n
Malicious actors can exploit this by transmitting specially crafted data packets containing excessively large integer values, triggering a bad_alloc error that causes immediate service termination.<\/p>\n
The vulnerability affects critical usage scenarios, including bRPC deployments functioning as Redis servers serving untrusted clients, and bRPC instances acting as Redis clients connecting to potentially compromised Redis services.\u00a0<\/p>\n
The attack vector requires only network access to the target service, making it particularly dangerous for internet-facing deployments.<\/p>\n
Notably, Apache bRPC version 1.14.0 attempted to address this issue by implementing memory allocation size limitations.\u00a0<\/p>\n
However, the fix contained a critical implementation flaw that allowed integer overflow conditions to bypass the security controls, leaving version 1.14.0 vulnerable to exploitation through different integer ranges.<\/p>\n
Tyler Zars receives credit for discovering and reporting this vulnerability.<\/p>\n
\n