The vulnerability is an out-of-bounds write that occurs during parsing of an empty RESP array in the Redis command parser of Apache bRPC. The bug allows an unauthenticated attacker to send a malformed Redis request, leading the parser to write to a non‑existent array index and crash the bRPC process. Because the write is uncontrolled, the result is a denial‑of‑service for the affected service.

All installations of Apache bRPC that enable the ServerOptions.redis_service feature and accept Redis traffic from external clients are affected. Any bRPC version released before 1.18.0 implements the vulnerable parser logic. Upgrading to bRPC 1.18.0 or later eliminates the flaw by refusing empty array headers and rejecting the forged commands with a parse error.

With a CVSS score of 9.1, this flaw can be triggered from any machine that can reach the bRPC instance's Redis port. The attack requires no authentication or elevated privileges. Because the only observable effect is a crash, the likely outcome is service interruption. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, but the simplicity of the trigger means that a malicious actor could cause repeated outages if the service is exposed.