CVE-2026-86146: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Apache Software Foundation Apache bRPC

Apache bRPC versions before 1.18.0 contain a vulnerability due to inconsistent HTTP/1.1 request parsing compared to front-end proxies or load balancers. The bRPC HTTP/1.1 parser accepts certain header formats that a conforming front-end either rejects or interprets differently, including spaces before colons in headers, interior spaces in Content-Length values, obsolete line folding of framing headers, and merging chunked trailer fields into the header map. These discrepancies allow attackers to smuggle HTTP requests, inject forged headers like Authorization or X-Forwarded-For, and cause response desynchronization when bRPC is deployed behind proxies or load balancers that parse HTTP messages independently. The vulnerability is fixed in bRPC version 1.18.0, which rejects these header forms by default and drops chunked trailers instead of merging them. Compatibility flags exist to restore acceptance of some obsolete forms if needed.

Remote attackers can exploit this vulnerability to perform HTTP request/response smuggling when bRPC is deployed behind proxies or load balancers that parse HTTP messages differently. This can lead to smuggled requests, injection of forged headers such as Authorization or X-Forwarded-For, and response desynchronization, potentially bypassing security controls or causing unintended behavior in HTTP communications.

Upgrade Apache bRPC to version 1.18.0, which includes an official fix rejecting problematic header forms and properly handling chunked trailers. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3521. After upgrading or patching, the default behavior rejects the four problematic header forms and drops chunked trailers instead of merging them. For compatibility, two flags (http_allow_obs_fold=true and http_strict_header_token=true) can be used to restore acceptance of some obsolete header forms if necessary. No other mitigation is required once the fix is applied.