CVE-2025-54472: Apache bRPC DoS Vulnerability

CVE-2025-54472 Overview

CVE-2025-54472 is an Integer Overflow vulnerability in the Redis protocol parser of Apache bRPC that enables remote attackers to execute denial-of-service attacks. The vulnerability stems from unlimited memory allocation triggered by maliciously crafted network packets, allowing attackers to crash bRPC services without authentication.

The flaw affects all versions of Apache bRPC prior to 1.14.1 across all platforms. Notably, version 1.14.0 attempted to address this issue but introduced an integer overflow bug in its limitation checking code, rendering the fix ineffective and leaving that version equally vulnerable, albeit with a different exploitable integer range.

Critical Impact

Remote attackers can crash Apache bRPC services by sending specially crafted packets that trigger excessive memory allocation, leading to a bad_alloc error and complete service denial.

Affected Products

• Apache bRPC versions prior to 1.14.0
• Apache bRPC version 1.14.0 (incomplete fix with integer overflow bypass)
• Any system using bRPC as a Redis server or client exposed to untrusted networks

Discovery Timeline

• 2025-08-14 - CVE-2025-54472 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-54472

Vulnerability Analysis

This vulnerability exists in the bRPC Redis protocol parser, which handles incoming network data to process Redis commands. The parser reads integer values from the network that specify the size of arrays or strings to be allocated. When these integers are excessively large, the parser attempts to allocate corresponding amounts of memory, resulting in a bad_alloc error that crashes the service.

The attack is particularly concerning because it requires no authentication and can be triggered remotely over the network. An attacker simply needs to send specially crafted data packets containing malicious integer values to any bRPC service operating as a Redis server or client.

The initial fix in version 1.14.0 introduced bounds checking to limit memory allocation sizes. However, the implementation contained an integer overflow flaw that attackers could exploit to bypass the size limitations. This means both pre-1.14.0 and 1.14.0 versions are vulnerable, though the specific integer ranges that trigger the vulnerability differ between versions.

Root Cause

The root cause is an Integer Overflow vulnerability (CWE-190) in the memory allocation logic within the Redis protocol parser. The parser trusts network-supplied integer values to determine allocation sizes without adequate validation. In version 1.14.0, the bounds checking logic itself is susceptible to integer overflow, allowing attackers to craft values that pass validation but still trigger excessive allocations.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. Attackers can exploit this vulnerability in two scenarios:

1. bRPC as Redis Server: When bRPC provides Redis services to untrusted clients, malicious clients can send crafted requests containing oversized integer values.

2. bRPC as Redis Client: When bRPC connects to untrusted Redis services, a malicious server can respond with crafted data containing oversized integers.

In both cases, the malicious data forces the parser to attempt memory allocations that exceed system capacity, causing the service to crash. The attack can be repeated continuously to maintain a denial-of-service condition.

Detection Methods for CVE-2025-54472

Indicators of Compromise

• Unexpected service crashes or restarts in bRPC-based applications
• Memory allocation failures (bad_alloc errors) in application logs
• Unusual network traffic patterns targeting Redis protocol ports
• Repeated connection attempts from suspicious IP addresses followed by service termination

Detection Strategies

• Monitor system logs for bad_alloc exceptions or memory allocation failures in bRPC processes
• Implement network intrusion detection rules to identify abnormally large integer values in Redis protocol traffic
• Deploy application performance monitoring to detect sudden service terminations
• Analyze core dumps from crashed services for evidence of memory exhaustion attacks

Monitoring Recommendations

• Enable detailed logging for bRPC services to capture memory allocation events
• Set up alerting on service availability and automatic restart patterns
• Monitor memory consumption trends for bRPC processes to detect allocation spikes
• Track network connection metadata to identify potential attack sources

How to Mitigate CVE-2025-54472

Immediate Actions Required

• Upgrade Apache bRPC to version 1.14.1 or later immediately
• If immediate upgrade is not possible, apply the security patch from GitHub PR #3050
• Review network segmentation to limit exposure of bRPC services to untrusted networks
• Consider implementing rate limiting on Redis protocol connections

Patch Information

Apache has released version 1.14.1 which properly addresses this vulnerability by implementing correct bounds checking on memory allocations. The patch introduces a configurable limit (redis_max_allocation_size) with a default maximum allocation of 64MB per parsing operation.

Organizations can apply the fix through either of these methods:

1. Upgrade to bRPC 1.14.1: The recommended approach that includes the complete fix
2. Manual Patch Application: Apply the patch from GitHub PR #3050 to existing installations

For more details, refer to the Apache Mailing List Thread or the Openwall OSS-Security Update.

Workarounds

• Restrict network access to bRPC Redis services using firewall rules to block untrusted sources
• Deploy a reverse proxy or application-level firewall to filter suspicious Redis protocol traffic
• Isolate bRPC services in network segments that only allow trusted client connections
• If Redis requests or responses legitimately exceed 64MB, configure the redis_max_allocation_size gflag after patching

# Configuration example after applying patch
# Modify the default 64MB allocation limit if needed for large Redis operations
# Add to bRPC startup configuration:
--redis_max_allocation_size=134217728  # Set to 128MB if required