CVE-2025-54472

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-54472", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-07-23T09:19:43.081Z", "datePublished": "2025-08-14T09:05:38.944Z", "dateUpdated": "2025-11-04T21:12:49.056Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache bRPC", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.14.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Tyler Zars"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions &lt; 1.14.1) on all platforms allows attackers to crash the service via network.<br><br>\n\n<span style=\"background-color: rgb(255, 255, 255);\">Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it.<br></span>The bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the&nbsp;1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version &lt; 1.14.0.<br><br>\n\n<span style=\"background-color: rgb(255, 255, 255);\">Affected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services.</span>\n\n<br><br>How to Fix: we provide two methods, you can choose one of them:<br><br>1. Upgrade bRPC to version 1.14.1.<br>2. Apply this patch (<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3050\">https://github.com/apache/brpc/pull/3050</a>) manually.<br><br><span style=\"background-color: rgb(255, 255, 255);\">No matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">redis_max_allocation_size to set a larger limit.</span></span><br><br>"}], "value": "Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network.\n\n\n\nRoot Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it.\nThe bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the\u00a01.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0.\n\n\n\nAffected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services.\n\n\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.14.1.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually.\n\nNo matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag\u00a0redis_max_allocation_size to set a larger limit."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-08-14T09:05:38.944Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/r3xsy3wvs4kmfhc281173k5b6ll1xt2m"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache bRPC: Redis Parser Remote Denial of Service", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-08-14T13:37:18.746439Z", "id": "CVE-2025-54472", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T14:49:23.869Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/08/12/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:12:49.056Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/08/12/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:12:49.056Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-54472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-14T13:37:18.746439Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-14T13:37:22.283Z"}}], "cna": {"title": "Apache bRPC: Redis Parser Remote Denial of Service", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Tyler Zars"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "versions": [{"status": "affected", "version": "0", "lessThan": "1.14.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/r3xsy3wvs4kmfhc281173k5b6ll1xt2m", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network.\n\n\n\nRoot Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it.\nThe bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the\u00a01.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0.\n\n\n\nAffected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services.\n\n\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.14.1.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually.\n\nNo matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag\u00a0redis_max_allocation_size to set a larger limit.", "supportingMedia": [{"type": "text/html", "value": "Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions &lt; 1.14.1) on all platforms allows attackers to crash the service via network.<br><br>\n\n<span style=\"background-color: rgb(255, 255, 255);\">Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it.<br></span>The bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the&nbsp;1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version &lt; 1.14.0.<br><br>\n\n<span style=\"background-color: rgb(255, 255, 255);\">Affected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services.</span>\n\n<br><br>How to Fix: we provide two methods, you can choose one of them:<br><br>1. Upgrade bRPC to version 1.14.1.<br>2. Apply this patch (<a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3050\">https://github.com/apache/brpc/pull/3050</a>) manually.<br><br><span style=\"background-color: rgb(255, 255, 255);\">No matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">redis_max_allocation_size to set a larger limit.</span></span><br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-08-14T09:05:38.944Z"}}}, "cveMetadata": {"cveId": "CVE-2025-54472", "state": "PUBLISHED", "dateUpdated": "2025-11-04T21:12:49.056Z", "dateReserved": "2025-07-23T09:19:43.081Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2025-08-14T09:05:38.944Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache bRPC", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.14.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*", "matchCriteriaId": "6ACE2C20-D9A0-4BD4-A011-F61D65B8FBC0", "versionEndExcluding": "1.14.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network.\n\n\n\nRoot Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it.\nThe bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the\u00a01.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0.\n\n\n\nAffected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services.\n\n\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.14.1.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually.\n\nNo matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag\u00a0redis_max_allocation_size to set a larger limit."}, {"lang": "es", "value": "La asignaci\u00f3n ilimitada de memoria en el analizador de protocolo Redis de Apache bRPC (todas las versiones anteriores a la 1.14.1) en todas las plataformas permite a los atacantes bloquear el servicio a trav\u00e9s de la red. Causa ra\u00edz: En el c\u00f3digo del analizador de protocolo Redis de bRPC, la memoria para matrices o cadenas de tama\u00f1os correspondientes se asigna en funci\u00f3n de los enteros le\u00eddos de la red. Si el entero le\u00eddo de la red es demasiado grande, puede causar un error de asignaci\u00f3n incorrecta y provocar el bloqueo del programa. Los atacantes pueden explotar esta caracter\u00edstica enviando paquetes de datos especiales al servicio bRPC para llevar a cabo un ataque de denegaci\u00f3n de servicio. La versi\u00f3n bRPC 1.14.0 intent\u00f3 solucionar este problema limitando el tama\u00f1o de la asignaci\u00f3n de memoria; sin embargo, el c\u00f3digo de comprobaci\u00f3n de limitaciones no est\u00e1 bien implementado, lo que puede causar un desbordamiento de enteros y evadir dicha limitaci\u00f3n. Por lo tanto, la versi\u00f3n 1.14.0 tambi\u00e9n es vulnerable, aunque el rango de enteros que afecta a la versi\u00f3n 1.14.0 es diferente al que afecta a la versi\u00f3n anterior. Escenarios afectados: Usar bRPC como servidor Redis para proporcionar servicios de red a clientes no confiables, o usar bRPC como cliente Redis para llamar a servicios Redis no confiables. C\u00f3mo solucionarlo: ofrecemos dos m\u00e9todos, puede elegir uno de ellos: 1. Actualice bRPC a la versi\u00f3n 1.14.1. 2. Aplique este parche (https://github.com/apache/brpc/pull/3050) manualmente. Independientemente del m\u00e9todo que elija, debe tener en cuenta que el parche limita la longitud m\u00e1xima de memoria asignada para cada vez en el analizador Redis de bRPC. El l\u00edmite predeterminado es 64M. Si alguna de sus solicitudes o respuestas de Redis tiene un tama\u00f1o mayor a 64M, podr\u00eda encontrar un error despu\u00e9s de la actualizaci\u00f3n. Para tal caso, puede modificar el gflag redis_max_allocation_size para establecer un l\u00edmite mayor."}], "id": "CVE-2025-54472", "lastModified": "2026-06-17T09:40:09.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54472", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-14T13:37:18.746439Z", "version": "2.0.3"}}]}, "published": "2025-08-14T09:15:26.683", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Patch", "Vendor Advisory"], "url": "https://lists.apache.org/thread/r3xsy3wvs4kmfhc281173k5b6ll1xt2m"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/08/12/2"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-400"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"created": "2025-08-14T12:59:56.439885+00:00", "updated": "2025-08-14T12:59:56.439956+00:00", "vendors": ["apache", "apache$PRODUCT$brpc"]}