CVE-2026-86146
Low risk· EPSS 10%Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
HTTP request/response smuggling vulnerability in Apache bRPC versions < 1.18.0 stems from inconsistent HTTP/1.1 header parsing in its bundled parser. bRPC accepts malformed header forms (space before colon, spaces in Content-Length values, obs-fold, chunked trailers merged as headers, Transfer-Encoding lists with whitespace), allowing attackers to smuggle requests or headers when bRPC is deployed behind a proxy or load balancer.
Risk Assessment
A remote attacker can smuggle requests or forge headers (e.g., Authorization, X-Forwarded-For), bypassing front-end access controls and potentially leading to unauthorized access or cache poisoning.
Recommendation
Upgrade Apache bRPC to version 1.18.0 or apply the patch from PR #3521. After the fix, consider enabling the http_strict_header_token=true flag for additional header validation.
Other vulnerabilities in Apache bRPC
See all- CVE-2025-60021Critical
Remote command injection vulnerability in heap profiler builtin service in Apache bRPC (all versions < 1.15.0) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter. Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.
- CVE-2026-90484Low risk· EPSS 4%
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A packet with declared zero payload length passes the frame-length check, after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, causing type = p[4] to dereference it and crash the client process.
- CVE-2026-87849Low risk· EPSS 5%
A vulnerability in the Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that they are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries triggers an out-of-bounds read and potentially crashes the bRPC client.
- CVE-2026-86249Low risk· EPSS 24%
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. Verification runs only for the first message of a connection and the result latches the connection, so a request such as GET /status to internal_port authenticates the whole connection.
- CVE-2026-86147Low risk· EPSS 10%
Apache bRPC versions before 1.18.0 expose builtin /flags and /pprof services that allow a remote attacker to change dump paths (bvar_dump_file, bvar_dump_tabs, mbvar_dump_file) and create directories or overwrite files with the server process privileges. Additionally, the ?seconds= parameter in /pprof is not clamped, enabling an attacker to hold the process-wide CPU profiler for an arbitrarily long time.
- CVE-2026-84748Low risk· EPSS 7%
Improper authorization in Apache bRPC (versions < 1.18.0) allows remote attackers to access builtin services through the public port. Protobuf-based protocol dispatch paths computed but did not enforce the security_mode flag, allowing invocation of services such as brpc.vars or hotspots.
- CVE-2026-84747Low risk· EPSS 11%
A vulnerability in Apache bRPC (versions < 1.18.0) stems from an interpretation conflict in HTTP path handling between bRPC and a front proxy. The FindMethodPropertyByURI() function skips empty path segments (consecutive slashes), so paths like //flags are dispatched as /flags, even though RFC 3986 treats them as distinct. Additionally, HTTP/2 does not validate the :path pseudo-header, allowing bypass of proxy ACL rules and access to internal services.
- CVE-2026-84727Medium
A use-after-free exists in the RTMP protocol implementation in Apache bRPC (version < 1.18.0). A malicious RTMP peer can crash the process or potentially corrupt memory via a crafted Abort message. The root cause is that the receive path deletes the target RtmpChunkStream object while the send path concurrently dereferences it without synchronization.
- CVE-2026-82953Low risk· EPSS 12%
A NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (versions < 1.18.0) occurs when the server rejects a createStream request by returning a null stream and then fails to write the error response, causing a crash. A remote attacker can trigger a denial of service by sending a crafted createStream command and closing the connection before the rejection response is written.
- CVE-2026-82942Low risk· EPSS 3%
A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. After the RDMA handshake completes, the server keeps parsing the TCP fd as an RPC channel, sharing the input buffer and parser state with RDMA CQ event processing without synchronization, leading to corruption and a crash.
Original NVD description (English source)
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently. Root Cause: The bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC: 1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC's framing while the reported field name contains the trailing space. 2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js). 3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC's framing while a front-end that does not unfold sees a different message. 4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it. 5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync. Affected Scenarios: bRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3521 Note: After applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS