Apache

A severe vulnerability in Apache bRPC (CVE-2025-54472) allows attackers to crash services by exploiting unlimited memory allocation in the Redis protocol parser. This affects all versions prior to 1.14.1. Attackers can send crafted packets with large integers, triggering memory allocation failures and causing immediate service termination. The vulnerability is particularly dangerous for internet-facing deployments, as it requires only network access. While version 1.14.0 attempted to fix the issue, a critical flaw left it vulnerable. Organizations are advised to upgrade to version 1.14.1 or apply the security patch to mitigate the risk.

Source: https://cybersecuritynews.com/apache-brpc-vulnerability/

TPRM report: https://www.rankiteo.com/company/the-apache-software-foundation

"id": "the207081225",
"linkid": "the-apache-software-foundation",
"type": "Vulnerability",
"date": "8/2025",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'industry': 'Technology',
                        'name': 'Apache bRPC',
                        'type': 'Software'}],
 'attack_vector': 'Network exploitation',
 'description': 'A severe vulnerability in Apache bRPC has been discovered '
                'that allows attackers to crash services through network '
                'exploitation, affecting all versions prior to 1.14.1. The '
                "vulnerability, identified as CVE-2025-54472 with 'important' "
                'severity classification, stems from unlimited memory '
                'allocation in the Redis protocol parser component.',
 'impact': {'operational_impact': 'Denial of Service'},
 'post_incident_analysis': {'corrective_actions': 'Implemented proper bounds '
                                                  'checking for memory '
                                                  'allocation requests with a '
                                                  'default maximum allocation '
                                                  'limit of 64MB per Redis '
                                                  'parser operation',
                            'root_causes': 'Unlimited memory allocation in the '
                                           'Redis protocol parser component'},
 'recommendations': ['Upgrade to Apache bRPC version 1.14.1',
                     'Apply the available security patch',
                     'Adjust redis_max_allocation_size gflag parameter if '
                     'processing Redis requests or responses exceeding 64MB'],
 'references': [{'source': 'Apache bRPC project documentation'}],
 'response': {'remediation_measures': ['Upgrade to Apache bRPC version 1.14.1',
                                       'Apply the available security patch']},
 'title': 'Apache bRPC Redis Protocol Parser Vulnerability',
 'type': 'Vulnerability',
 'vulnerability_exploited': 'CVE-2025-54472'}