CVE-2025-54472
Published: 14 August 2025
Summary
CVE-2025-54472 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Apache Brpc. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 19.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Apache bRPC contains an unlimited memory allocation flaw in its Redis protocol parser affecting all versions prior to 1.14.1 on every platform. The parser allocates memory for arrays or strings using integer sizes read directly from the network; excessively large values trigger a bad_alloc condition that crashes the process. Version 1.14.0 attempted to add a size limit but introduced an integer-overflow bypass, leaving it equally vulnerable. The issue is tracked as CWE-190 and CWE-400 with a CVSS 3.1 score of 7.5.
An unauthenticated network attacker can send a single specially crafted Redis-protocol packet to any bRPC instance that acts as a Redis server for untrusted clients or as a Redis client connecting to untrusted servers, resulting in an immediate denial-of-service crash. No authentication or user interaction is required.
Public advisories direct users to upgrade to bRPC 1.14.1 or to apply the patch from GitHub pull request 3050. The fix caps each allocation at a default of 64 MiB (tunable via the redis_max_allocation_size gflag) to prevent oversized requests from reaching the allocator.
EPSS remains flat at 0.0140 with no material increase after disclosure, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24682
Vulnerability details
Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of…
more
corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it. The bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the 1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0. Affected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.14.1. 2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually. No matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag redis_max_allocation_size to set a larger limit.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limiting concurrent sessions directly prevents uncontrolled resource consumption by capping the number of active sessions per user or account.
Analysis identifies uncontrolled resource consumption indicative of denial-of-service or abuse attempts.
Contingency plan testing includes resource exhaustion scenarios to verify recovery, making it harder for attackers to sustain exploits that cause uncontrolled consumption.
Updated contingency plans include current procedures to detect, contain, and recover from resource exhaustion, limiting an attacker's ability to sustain impact from uncontrolled consumption.
Alternate site allows resumption of operations if resource exhaustion at the primary site is exploited to cause unavailability.
Alternate telecommunications services enable resumption of essential functions when primary services become unavailable due to uncontrolled resource consumption.
The team can analyze and respond to resource exhaustion incidents, reducing the impact of attacks that exploit uncontrolled consumption weaknesses.
Timely maintenance support and spare parts enable rapid recovery from failures induced by uncontrolled resource consumption, shortening the impact window of denial-of-service attacks.