CVE-2026-56388

The Apache bRPC Redis server command parser is vulnerable to an out-of-bounds write due to improper handling of empty RESP arrays. When a remote unauthenticated attacker sends an empty array header followed by a bulk string, the parser resizes the command argument vector to zero elements but cont...

CVE-2026-56388 Apache bRPC: Out-of-Bounds Write in Redis Command Parser

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...

EUVD-2026-107174

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...

PT-2026-120533

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...