CVE-2026-66392: CWE-297 Improper Validation of Certificate with Host Mismatch in Apache Software Foundation Apache bRPC

Apache bRPC versions prior to 1.18.0 perform server certificate chain validation when client TLS peer verification is enabled but fail to bind the certificate to the expected DNS name or IP address. This improper validation (CWE-297) can allow a network attacker who can intercept or redirect connections and possesses a certificate issued by a trusted CA for a different identity to impersonate the requested TLS endpoint. The vulnerability affects scenarios where applications use a bRPC client Channel to connect over untrusted networks with certificate verification enabled and trust a CA that can issue certificates for identities other than the intended endpoint. The issue is resolved in Apache bRPC 1.18.0 by enabling VERIFY_PEER with a positive verify_depth and performing DNS or IP Subject Alternative Name (SAN) verification during the TLS handshake. Users can also explicitly set the expected peer name if it differs from the URL host. A patch is available at the project's GitHub repository.

An attacker capable of intercepting or redirecting network connections can impersonate the legitimate TLS endpoint if they have a certificate issued by a trusted CA for a different name. This undermines the trust model of TLS connections, potentially allowing man-in-the-middle attacks and unauthorized access to sensitive data or services relying on Apache bRPC client TLS connections.

Upgrade Apache bRPC to version 1.18.0 or later. Ensure that VERIFY_PEER is enabled with a positive verify_depth. Use HTTPS Channels which automatically verify the certificate against the host in the Channel URL. If the certificate identity differs from the URL host, explicitly set VerifyOptions::expected_peer_name. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3408. Avoid configurations that set expected_peer_name while peer verification is disabled, as these are rejected.