CVE-2025-54472
Apache bRPC: Redis Parser Remote Denial of Service
Description
Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it. The bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the 1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0. Affected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.14.1. 2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually. No matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag redis_max_allocation_size to set a larger limit.
INFO
Published Date :
Aug. 14, 2025, 9:15 a.m.
Last Modified :
Aug. 18, 2025, 6:35 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Upgrade Apache bRPC to version 1.14.1 or later.
- Apply the provided patch if upgrading is not possible.
- Adjust redis_max_allocation_size if large requests/responses occur.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-54472.
| URL | Resource |
|---|---|
| https://lists.apache.org/thread/r3xsy3wvs4kmfhc281173k5b6ll1xt2m | Mailing List Vendor Advisory Patch |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-54472 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-54472
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-54472 vulnerability anywhere in the article.
-
Daily CyberSecurity
CVE-2025-54988: Critical XXE Vulnerability in Apache Tika PDF Parser Exposes Sensitive Data
The widely used Apache Tika toolkit, a powerful library for detecting and extracting metadata and text from over a thousand file formats, has been found vulnerable to a critical XML External Entity (X ... Read more
-
TheCyberThrone
SAP Patch Tuesday August 2025
August 13, 2025SAP’s August 2025 Patch Tuesday addresses 25–26 security issues with an emphasis on several critical vulnerabilities involving code injection and insecure deserialization. The updates p ... Read more
-
TheCyberThrone
Microsoft Patch Tuesday August 2025
August 13, 2025Microsoft’s August 2025 Patch Tuesday brought critical security updates for 107 vulnerabilities across its products. Below is an enhanced, note-rich breakdown, with real-world exploitat ... Read more
-
CybersecurityNews
Apache bRPC Vulnerability Allows Attackers to Crash the Service via Network
A severe vulnerability in Apache bRPC has been discovered that allows attackers to crash services through network exploitation, affecting all versions prior to 1.14.1. The vulnerability, identified as ... Read more
-
Daily CyberSecurity
Critical Erlang/OTP Flaw (CVE-2025-32433) Under Active Exploitation, Allowing Unauthenticated RCE on OT Networks
Security researchers at Unit 42 have issued an urgent warning regarding CVE-2025-32433, a CVSS 10.0-rated vulnerability in the Secure Shell (SSH) daemon used by certain versions of the Erlang/OTP fram ... Read more
-
Daily CyberSecurity
Apache bRPC Flaw (CVE-2025-54472) Allows Remote Denial-of-Service Attack
The Apache bRPC project has issued an important security advisory addressing a critical flaw in its Redis protocol parser that could allow attackers to crash affected services remotely. The vulnerabil ... Read more
The following table lists the changes that have been made to the
CVE-2025-54472 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Aug. 18, 2025
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:* versions up to (excluding) 1.14.1 Added Reference Type Apache Software Foundation: https://lists.apache.org/thread/r3xsy3wvs4kmfhc281173k5b6ll1xt2m Types: Mailing List, Patch, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 14, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H -
New CVE Received by [email protected]
Aug. 14, 2025
Action Type Old Value New Value Added Description Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it. The bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the 1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0. Affected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.14.1. 2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually. No matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag redis_max_allocation_size to set a larger limit. Added CWE CWE-190 Added CWE CWE-400 Added Reference https://lists.apache.org/thread/r3xsy3wvs4kmfhc281173k5b6ll1xt2m