« Volver al listado

CVE-2025-54472

Estado: ModificadaAlta (7.5)—

Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network.

Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it.

Leer descripción completaMostrar menos

The bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the 1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0.

Affected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services.

How to Fix: we provide two methods, you can choose one of them:

1. Upgrade bRPC to version 1.14.1. 2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually.

No matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag redis_max_allocation_size to set a larger limit.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS AV:N/AC:L/PR:N/UI:N indica red sin privilegios. La vulnerabilidad permite DoS mediante asignación ilimitada de memoria en el parser de Redis expuesto en red.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Apache — Brpc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-54472",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54472",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-14T13:37:18.746439Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache bRPC",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.14.1",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-14T09:15:26.683",
  "references": [
    {
      "url": "https://lists.apache.org/thread/r3xsy3wvs4kmfhc281173k5b6ll1xt2m",
      "tags": [
        "Mailing List",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/08/12/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        },
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network.\n\n\n\nRoot Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it.\nThe bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the 1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0.\n\n\n\nAffected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services.\n\n\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.14.1.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually.\n\nNo matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag redis_max_allocation_size to set a larger limit."
    },
    {
      "lang": "es",
      "value": "La asignación ilimitada de memoria en el analizador de protocolo Redis de Apache bRPC (todas las versiones anteriores a la 1.14.1) en todas las plataformas permite a los atacantes bloquear el servicio a través de la red. Causa raíz: En el código del analizador de protocolo Redis de bRPC, la memoria para matrices o cadenas de tamaños correspondientes se asigna en función de los enteros leídos de la red. Si el entero leído de la red es demasiado grande, puede causar un error de asignación incorrecta y provocar el bloqueo del programa. Los atacantes pueden explotar esta característica enviando paquetes de datos especiales al servicio bRPC para llevar a cabo un ataque de denegación de servicio. La versión bRPC 1.14.0 intentó solucionar este problema limitando el tamaño de la asignación de memoria; sin embargo, el código de comprobación de limitaciones no está bien implementado, lo que puede causar un desbordamiento de enteros y evadir dicha limitación. Por lo tanto, la versión 1.14.0 también es vulnerable, aunque el rango de enteros que afecta a la versión 1.14.0 es diferente al que afecta a la versión anterior. Escenarios afectados: Usar bRPC como servidor Redis para proporcionar servicios de red a clientes no confiables, o usar bRPC como cliente Redis para llamar a servicios Redis no confiables. Cómo solucionarlo: ofrecemos dos métodos, puede elegir uno de ellos: 1. Actualice bRPC a la versión 1.14.1. 2. Aplique este parche (https://github.com/apache/brpc/pull/3050) manualmente. Independientemente del método que elija, debe tener en cuenta que el parche limita la longitud máxima de memoria asignada para cada vez en el analizador Redis de bRPC. El límite predeterminado es 64M. Si alguna de sus solicitudes o respuestas de Redis tiene un tamaño mayor a 64M, podría encontrar un error después de la actualización. Para tal caso, puede modificar el gflag redis_max_allocation_size para establecer un límite mayor."
    }
  ],
  "lastModified": "2026-06-17T09:40:09.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6ACE2C20-D9A0-4BD4-A011-F61D65B8FBC0",
              "versionEndExcluding": "1.14.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}