CVE-2026-56388

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process. Root Cause: RedisCommandParser::ConsumeImpl rejected negative RESP array counts but accepted zero. It resized the command argument vector to zero elements and continued parsing. When a following bulk string was parsed, the only index guard was a CHECK. In configurations where fatal logs do not abort immediately, execution could continue and write to _args[0] even though the vector was empty. Affected Scenarios: Deployments that enable ServerOptions.redis_service and accept Redis protocol traffic from untrusted clients. The issue is reached during parsing before command handling or authentication. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3354 Note: The fix rejects empty RESP arrays as invalid Redis commands and replaces the internal index CHECK with an explicit parse error so malformed command streams cannot fall through to an indexed vector write.

• CWE-252
• CWE-617
• CWE-787

• https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56382Craft CMS (composer package craftcms/cms) versions >= 5.5.0 …7.2
• CVE-2026-56383Craft CMS contains a stored cross-site scripting (XSS) vulne…4.8
• CVE-2026-56384Craft CMS contains a missing authorization vulnerability in …4.3
• CVE-2026-56385Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1,…4.3
• CVE-2026-56386Integer underflow and out-of-bounds read in the HTTP/2 serve…7.5
• CVE-2026-56387The RTMP AMF parser in Apache bRPC accepts AMF string length…7.5
• CVE-2026-56389GNU Bison allows for an execution of an arbitrary program du…8.6
• CVE-2026-5639A flaw has been found in PHPGurukul Online Shopping Portal P…6.3
• CVE-2026-56390GNU Bison improperly handles grammar‑defined output paths. G…6.3
• CVE-2026-56391GNU coreutils uniq is vulnerable to an out‑of‑bounds read du…6.1
• CVE-2026-56392GNU coreutils unexpand is vulnerable to a heap-based buffer …6.1
• CVE-2026-56393Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.…4.8