External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote… (CVE-2026-86147)

Apache bRPC versions before 1.18.0 have two main security issues in their builtin services. First, the /flags service allows modification of gflags controlling dump paths (bvar_dump_file, bvar_dump_tabs, mbvar_dump_file) without proper validation, enabling remote attackers to create directories and overwrite files arbitrarily with server process privileges. The dump path flags accept any value, and tab names can include '..' sequences to escape directories. Second, the /pprof service does not limit the ?seconds= parameter, allowing attackers to hold the CPU or contention profiler for extremely long periods, causing denial of profiling services (503 errors) for others. These vulnerabilities arise because the dump path flags lack sanitization and the profiling duration is unbounded. The issues are resolved in bRPC 1.18.0, which disables runtime modification of these dump path flags via /flags and caps profiling duration by a configurable maximum (default 300 seconds).

Remote attackers who can access the builtin service port on an Apache bRPC server can create or overwrite files and directories at arbitrary locations with the privileges of the server process, potentially leading to data corruption or unauthorized file manipulation. Additionally, attackers can cause denial of profiling services by holding the CPU or contention profiler for extended periods, impacting server monitoring and diagnostics. These impacts require access to the builtin service port, which is enabled by default on the same port as normal RPC traffic, thus exposing the server to risk if accessible from untrusted networks.

Upgrade Apache bRPC to version 1.18.0, which includes fixes that prevent runtime modification of dump path flags via the /flags service and enforce a maximum profiling duration for the /pprof service. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3523. After upgrading or patching, the dump path flags can only be changed programmatically and not via the /flags service, and profiling duration is capped by the -max_profiling_seconds gflag (default 300 seconds), which can be adjusted by the server owner. Restrict access to the builtin service port from untrusted networks to reduce exposure.