The Apache bRPC server’s Redis protocol implementation incorrectly parses inline commands, allocating and copying the entire incoming buffer before validating the CRLF terminator. This permits a remote attacker to inject an excessively long inline command without a terminating CRLF, leading the service to consume large amounts of memory and CPU in copy operations. The result is a denial of service that can render the bRPC service unavailable to legitimate clients. The flaw is a classic Resource Exhaustion vulnerability (CWE-770).

The flaw affects installations of Apache bRPC that expose the Redis-compatible protocol to untrusted clients. The problem exists in all versions prior to 1.18.0. The issue is mitigated by applying the 1.18.0 release or the patch from PR 3363, which enforces the redis_max_allocation_size limit on inline commands.

Based on the description, the attack vector is a remote client sending data directly to the Redis protocol endpoint. Because the vulnerability can be triggered without authentication, an attacker only needs network connectivity to the bRPC service. The exploit saturates memory and CPU to crash the service. The EPSS score is 0.00202 (<1%), and the vulnerability is not listed in the CISA KEV catalog, yet the lack of access controls and the high potential impact make it a significant risk for exposed deployments.