Apache Software Foundation Apache Brpc vulnerabilities

CVE-2025-60021 [CRITICAL] CWE-77 CVE-2025-60021: Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all version Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attack

CVE-2022-32213 [MEDIUM] CWE-444 CVE-2022-32213: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

CVE-2023-31039 [CRITICAL] CWE-20 CVE-2023-31039: Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary Security vulnerability in Apache bRPC = 1.5.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2218 https://github.com/apache/brpc/pull/2218

CVE-2025-59789 [HIGH] CWE-674 CVE-2025-59789: Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms a Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote attackers to make the server crash via sending deep recursive json data. Root Cause: The bRPC json2pb component uses rapidjson to parse json data from the network. The rapidjson parser uses a recursive parsing method by default. If the inp

CVE-2026-82230 [HIGH] CWE-674 CVE-2026-82230: Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth

CVE-2024-23452 [HIGH] CWE-444 CVE-2024-23452: Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows at Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description： The http_parser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a Transfer-Encoding and a Content-Length header field, such a me

CVE-2026-56386 [HIGH] CWE-125 CVE-2026-56386: Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allow Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payl

CVE-2025-54472 [HIGH] CWE-190 CVE-2025-54472: Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all p Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the

CVE-2026-48830 CWE-287 CVE-2026-48830: Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to by Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request

CVE-2026-78334 CWE-306 CVE-2026-78334: Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured, streaming RPC frames are consumed directly by the streaming parse

CVE-2026-86249 CWE-287 CVE-2026-86249: On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built- On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a built-in service is requested on internal_port, and this verdict is not per - request: verification r

CVE-2026-74757 [HIGH] CWE-770 CVE-2026-74757: Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts the item count stored in the mcpack array header wit

CVE-2026-78058 CWE-400 CVE-2026-78058: Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clients, trusts the pee

CVE-2026-84747 CWE-436 CVE-2026-84747: Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function FindMethodPropertyByURI() in bRPC's HTTP protocol splits the request path with a string splitter that skips empty fields, so

CVE-2026-90484 [MEDIUM] CWE-476 CVE-2026-90484: The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sen The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (is_full_package), after which the parser reads the response type byte via an unbounded 5-byte fetch that returns n

CVE-2026-84727 [MEDIUM] CWE-416 CVE-2026-84727: Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platform Use-after-free in the RTMP protocol implementation in Apache bRPC (version RtmpChunkStream::SerializeMessage) runs concurrently on sender threads and dereferences the same RtmpChunkStream object without synchronization. If a remote peer sends an Abort message naming a chunk stream that is concurrently being used to serialize an outgoing message, the

CVE-2026-56388 CWE-252 CVE-2026-56388: The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A re The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process. Root Cause: RedisCommandParser::ConsumeImpl r

CVE-2026-74758 CWE-416 CVE-2026-74758: A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a rem A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: When an RTMP Abort control message names the chunk stream that is currently being parsed (the chunk st

CVE-2026-86147 CWE-73 CVE-2026-86147: External control of file name or path and uncontrolled resource consumption in Apache bRPC (version External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the process-wide CPU/contention profiler for an arbitrarily long ti

CVE-2026-74755 CWE-191 CVE-2026-74755: An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms a An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE