Apache bRPC’s Redis reply parser recurses once for every nested array level without enforcing a depth limit. When a remote Redis server returns a deeply nested RESP array, the parser consumes stack space until the process crashes. This bug is identified as CWE‑674 and results in a denial‑of‑service condition that disables the bRPC client process.

The vulnerability affects all versions of Apache bRPC older than 1.18.0 that are used as a Redis client (ChannelOptions.protocol="redis"). The affected vendor is Apache Software Foundation, and the product impacted is Apache bRPC.

The fault can be triggered by any Redis server that returns a deeply nested reply; thus a malicious or misbehaving server can cause stack exhaustion. EPSS score is < 1% and the CVSS score is 7.5, and the vulnerability is not listed in CISA’s KEV catalog. The risk is limited to environments where the bRPC client connects to an untrusted or compromised Redis peer and is best evaluated by the receiving application’s risk posture.