CVE-2026-84747: CWE-436 Interpretation Conflict in Apache Software Foundation Apache bRPC

Apache bRPC before version 1.18.0 has a vulnerability (CWE-436) in its HTTP protocol implementation where the method dispatch function FindMethodPropertyByURI() collapses empty path segments (consecutive slashes) in request URIs, causing different paths to be treated as the same. Front proxies enforcing access control lists (ACLs) on the literal path may block certain paths like /flags but allow variants with empty segments such as //flags, which the bRPC server treats as /flags. This discrepancy allows attackers to bypass ACLs. Furthermore, the HTTP/2 implementation does not validate the :path pseudo-header correctly, permitting requests with missing or malformed :path values that violate RFC 9113 section 8.3.1. The vulnerability affects deployments where Apache bRPC is behind a front proxy that performs ACL decisions based on literal paths and accepts HTTP/HTTP2 traffic from that proxy.

Attackers can bypass front proxy access control rules by sending specially crafted HTTP or HTTP/2 requests with empty path segments or malformed :path pseudo-headers. This allows unauthorized access to protected builtin services or resources that the front proxy intended to block, potentially exposing sensitive functionality or data.

Upgrade Apache bRPC to version 1.18.0, which addresses these issues by rejecting HTTP and HTTP/2 request paths containing empty path segments and validating the HTTP/2 :path pseudo-header according to RFC standards. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3512. After the fix, the server rejects malformed paths by default. Deployments requiring previous lenient behavior can enable the gflag -http_allow_empty_path_segments, though this is not recommended for servers exposed to untrusted traffic.