Apache bRPC: denial of service

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service.

Root Cause:

The Redis inline command parser allocated memory based on the current input buffer size and copied the entire buffer before determining the current inline command boundary. The existing redis_max_allocation_size limit was applied to RESP bulk strings and arrays, but not effectively to the inline command path before allocation.

Affected Scenarios:

Use Apache bRPC server with Redis protocol enabled and reachable by untrusted clients.

How to Fix:

1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.

2. Apply the patch from PR https://github.com/apache/brpc/pull/3363 .

Note:

The fix applies redis_max_allocation_size to Redis inline command lines and scans for CRLF before allocating parser arena memory. Inline command lines exceeding this limit are rejected.