Apache Software Foundation Apache Brpc vulnerabilities

CVE-2026-82942 CWE-362 CVE-2026-82942: A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an

CVE-2026-54425 CWE-674 CVE-2026-54425: Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attack Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field

CVE-2026-84748 CWE-285 CVE-2026-84748: Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers t Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internal_port is documented to make builtin services (and Tabbed services) reachable only from the internal port, and the HTTP/h2 dispatch path enforced this. However, all protobuf-b

CVE-2026-61902 CWE-400 CVE-2026-61902: Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of servic

CVE-2026-87849 [MEDIUM] CWE-125 CVE-2026-87849: The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object- The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON obje

CVE-2026-82953 [MEDIUM] CWE-476 CVE-2026-82953: NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on al NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version _onfail_id, causing the process to crash. Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream() may return null (i.e., the service rejects createStream requests). A remote client that sends a createStream command and then closes the conn

CVE-2026-56387 CWE-770 CVE-2026-56387: The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrust The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation or resource consumption before the parser r

CVE-2026-82210 CWE-617 CVE-2026-82210: Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms al Enforceable assertion in the streaming feature of Apache bRPC (version 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the proces

CVE-2026-78048 CWE-617 CVE-2026-78048: A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version = 1 byte + value >= 1 byte + 32 bytes of overhead). However, RFC 7541 section 4.1 specifies that the minimum entry size is 33 bytes, because the value may be empty (name >= 1 byte + value == 0 + 32 bytes). For the default 4096-byte table th

CVE-2026-58064 CWE-770 CVE-2026-58064: The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potenti

CVE-2026-61916 CWE-125 CVE-2026-61916: Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit set. Root Cause: Two 256-entry lookup tables are accessed through

CVE-2026-54427 CWE-674 CVE-2026-54427: Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack. Affected Scenarios: Applications using bRPC RTMP support and parsing AM

CVE-2026-81755 CWE-400 CVE-2026-81755: Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) a Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root Cause: In the streaming RPC feature, a client can declare multiple streams in one RPC request by pu

CVE-2026-80463 CWE-770 CVE-2026-80463: Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0 Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to exhaust the memory of a server (denial of service) by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds every single data frame by max_body_size, but a fragment

CVE-2026-82425 CWE-617 CVE-2026-82425: A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote p A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. Root Cause: When a Socket with health checking enabled fails, Socket::WaitAndReset closes its file descriptor while the event dispatcher may still be delivering an input event (EPOLLIN/EVFILT_READ) tha

CVE-2026-78066 CWE-770 CVE-2026-78066: Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1) The gzip/zlib/snappy decompressors enforce no output limit:

CVE-2026-79704 CWE-125 CVE-2026-79704: An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11 An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional stream. The response handling path indexed the returned identifiers using the loca

CVE-2026-54426 CWE-674 CVE-2026-54426: Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis serve Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a configurable Redis reply depth limit with default value 128 and reje

CVE-2026-82231 CWE-248 CVE-2026-82231: A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) ca A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::length_error). The e

CVE-2023-45757 [MEDIUM] CWE-79 CVE-2023-45757: Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code t Security vulnerability in Apache bRPC 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411 3. disable rpcz feature