CVE-2026-56388 Apache bRPC: Out-of-Bounds Write in Redis Command Parser

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...

EUVD-2026-107174

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...

CVE-2026-56388

The Apache bRPC Redis server command parser is vulnerable to an out-of-bounds write due to improper handling of RESP array counts. Specifically, RedisCommandParser::ConsumeImpl accepted zero as a count, resizing the command argument vector to zero elements. If an attacker sends an empty RESP arra...

PT-2026-120533

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. The redis-cli command-line tool and the redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This issue arises due to a vulnerability in the hiredis...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection in AbstractAggregateConnection::write in src/Connection/AbstractAggregateConnection.php, which re-parses the already serialized pipeline buffer by splitting on \r\n and rebuilding chunks through Command::deserializeComman...

GHSA-W6F5-V2H6-G786 Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Summary An improper CRLF neutralization flaw in Predis' pipeline handling on aggregate connections lets an unauthenticated attacker who can influence any pipelined argument — a value or a key, e.g. a URL slug used as a cache key — smuggle arbitrary Redis commands into the connection. - On cluster...

Malicious code in auth0-chalk-redis-command (npm)

The package auth0-chalk-redis-command was found to contain malicious code. --- Credit: OpenSSF source...

USN-8401-1: Netty vulnerabilities

It was discovered that Netty's HTTP proxy handler did not properly validate headers when constructing CONNECT requests. An attacker could possibly use this issue to inject arbitrary HTTP headers into CONNECT requests. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,...

USN-8401-1 netty vulnerabilities

It was discovered that Netty's HTTP proxy handler did not properly validate headers when constructing CONNECT requests. An attacker could possibly use this issue to inject arbitrary HTTP headers into CONNECT requests. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,...

EUVD-2019-19104

Malware in sbrugna...

EUVD-2025-14851

Malicious code in bioql PyPI...

MAL-2025-43545 Malicious code in auth0-chalk-redis-command (npm)

The package auth0-chalk-redis-command was found to contain malicious code...

CVE-2025-26268

DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service daemon crash via a crafted Redis command. The validity of the scan cursor was not checked...

CVE-2025-26268

DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service daemon crash via a crafted Redis command. The validity of the scan cursor was not checked...

CVE-2025-26268

DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service daemon crash via a crafted Redis command. The validity of the scan cursor was not checked...

CVE-2025-26268

DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service daemon crash via a crafted Redis command. The validity of the scan cursor was not checked...

CVE-2025-26268

DragonflyDB pre-1.27.0 is affected. Authenticated users can trigger a denial of service (daemon crash) by sending a crafted Redis command, caused by the scan cursor validity check being missing. Affected: DragonflyDB Dragonfly versions prior to 1.27.0. Remediation: upgrade to 1.27.0 or later (or ...

PT-2025-17214 · Redis +1 · Redis +1

Name of the Vulnerable Software and Affected Versions: DragonflyDB Dragonfly versions prior to 1.27.0 Description: The issue allows authenticated users to cause a denial of service, resulting in a daemon crash, by sending a crafted Redis command. The problem stems from the lack of validation of t...

CVE-2025-26268

DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service daemon crash via a crafted Redis command. The validity of the scan cursor was not checked...