PT-2025-32668 · Apache · Apache Brpc

Tyler Zars · Published 2025-08-12 · Updated 2025-09-17 · CVE-2025-54472

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Apache bRPC versions prior to 1.14.1

Description: A flaw in the Redis parser within Apache bRPC allows unauthenticated remote attackers to crash services by triggering unlimited memory allocation. This issue affects the service via network communication. Approximately 103 potentially affected devices have been identified.

Recommendations: Update to version 1.14.1.

Fix

DoS

Resource Exhaustion

Integer Overflow

Weakness Enumeration

CWE-400

CWE-190

Related Identifiers

CVE-2025-54472

Affected Products

Apache Brpc

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-54472 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54472 · Vendor Advisory
• https://twitter.com/Komodosec/status/1968329897560150147 · Twitter Post
• https://twitter.com/CVEnew/status/1955931284062265659 · Twitter Post
• https://lists.apache.org/thread/r3xsy3wvs4kmfhc281173k5b6ll1xt2m · Vendor Advisory, Patch
• https://twitter.com/oss_security/status/1955091876207267874 · Twitter Post
• http://openwall.com/lists/oss-security/2025/08/12/2 · Note
• https://twitter.com/zoomeye_team/status/1955160310211588497 · Twitter Post
• https://t.me/pentestingnews/66171 · Telegram Post
• https://twitter.com/rewterz/status/1955514432458838354 · Twitter Post
• https://twitter.com/CCBalert/status/1957431888118714382 · Twitter Post
• https://twitter.com/fridaysecurity/status/1955102391906501050 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1955101667453702610 · Twitter Post