Allocation of Resources Without Limits or Throttling in Apache bRPC - CVE-2026-58064
Published: October 23, 2026
Vulnerability identifier: #VU157343
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58064
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through excessive memory use and CPU copying overhead.
The vulnerability exists due to uncontrolled resource allocation in Apache bRPC's Redis inline command parser when allocating and copying the entire connection buffer before locating a complete CRLF-terminated command. A remote attacker can send long inline inputs without a terminating CRLF to repeatedly increase allocation and copying costs and potentially make the service unavailable.
Affected software
Apache bRPC
How to mitigate CVE-2026-58064
Install security update from vendor's website.
Apache bRPC - update to 1.18.0