CVE-2026-56388

The Apache bRPC Redis server command parser is vulnerable to an out-of-bounds write due to improper handling of RESP array counts. Specifically, RedisCommandParser::ConsumeImpl accepted zero as a count, resizing the command argument vector to zero elements. If an attacker sends an empty RESP arra...