apache/brpc vulnerabilities

Latest apache/brpc CVEs

Newest publication first · page 1 of 2

1. CVE-2026-90484 Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash

   Published 2026-10-21

   Medium·CVSS 6.5 EPSS 0.38%

   The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (is_full_package), after which the parser re...

2. CVE-2026-87849 Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing

   Published 2026-10-21

   Medium·CVSS 4.3 EPSS 0.35%

   The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list conta...

3. CVE-2026-86249 Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth

   Published 2026-10-21

   Critical·CVSS 9.1 EPSS 0.56%

   On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a built-in service is r...

4. CVE-2026-86147 Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.55%

   External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server proce...

5. CVE-2026-86146 Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.55%

   Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer th...

6. CVE-2026-84748 Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.43%

   Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internal_port is documented to make builtin services (and Tabbed services) reachable only from the inte...

7. CVE-2026-84747 Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments

   Published 2026-10-21

   High·CVSS 7.5 EPSS 0.46%

   Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function FindMethodPropertyByURI() in bRPC's HTTP proto...

8. CVE-2026-84727 Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message

   Published 2026-10-21

   Medium·CVSS 5.4 EPSS 0.32%

   Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message. Root Cause: When processing an RTMP Abort (protocol control message t...

9. CVE-2026-82953 Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service

   Published 2026-10-21

   Medium·CVSS 5.3 EPSS 0.48%

   NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command. Root Cause: When an RTMP service rejects a createStream request by r...

10. CVE-2026-82942 Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.39%

    A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the...

11. CVE-2026-82425 Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.42%

    A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. Root Cause: When a Socket with health checking enabled fails, Socket::WaitAndReset closes its file descriptor while the ev...

12. CVE-2026-82231 Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.42%

    A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thr...

13. CVE-2026-82230 Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.55%

    Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc r...

14. CVE-2026-82210 Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.50%

    Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame. Root Cause: When handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteC...

15. CVE-2026-81755 Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.73%

    Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root Cause: In the stream...

16. CVE-2026-80463 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.57%

    Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to exhaust the memory of a server (denial of service) by sending an endless sequence of continuation data frames. Root Cause: The streami...

17. CVE-2026-79704 Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.51%

    An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional st...

18. CVE-2026-78334 Apache bRPC: Missing Authentication for Streaming RPC Frames

    Published 2026-10-21

    Critical·CVSS 9.1 EPSS 0.66%

    Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication...

19. CVE-2026-78066 Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.51%

    Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the proc...

20. CVE-2026-78058 Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.81%

    Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled...

21. CVE-2026-78048 Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.63%

    A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of servic...

22. CVE-2026-74758 Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.65%

    A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: When an RTMP Abort cont...

23. CVE-2026-74757 Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.63%

    Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpa...

24. CVE-2026-74755 Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service

    Published 2026-10-21

    High·CVSS 7.5 EPSS 0.57%

    An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes _size - 1 with...

25. CVE-2026-66392 Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names

    Published 2026-10-21

    Medium·CVSS 5.9 EPSS 0.21%

    Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certific...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.