Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on… (CVE-2026-86146)
Description
Apache bRPC versions prior to 1.18.0 contain an HTTP request/response smuggling vulnerability due to inconsistent parsing of HTTP/1.1 headers. This allows remote attackers to desynchronize the bRPC parser from front-end proxies or load balancers, enabling request smuggling and header injection such as forged Authorization or X-Forwarded-For headers. The issue arises from bRPC accepting obsolete or non-standard header forms that front-ends reject or interpret differently. The vulnerability is fixed in bRPC version 1.18.0.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the bRPC fork of http-parser accepting HTTP/1.1 header forms that front-end proxies or load balancers interpret differently or reject. These include acceptance of spaces before colons in headers, skipping interior spaces in Content-Length values, acceptance of obsolete line folding in framing headers, merging chunked trailer fields into the header map, and improper recognition of Transfer-Encoding lists with optional whitespace. This discrepancy allows an attacker sending requests through a front-end to cause request smuggling, header injection (e.g., Authorization, X-Forwarded-For), or response desynchronization. The issue affects bRPC versions before 1.18.0 on all platforms. The fix in 1.18.0 rejects these problematic header forms by default and drops chunked trailers instead of merging them. Compatibility flags exist to restore legacy behavior if needed.
Potential Impact
Remote attackers can exploit this vulnerability when bRPC is deployed behind a proxy or load balancer that parses HTTP messages differently. Exploitation can lead to HTTP request smuggling, allowing attackers to inject or forge headers such as Authorization or X-Forwarded-For, potentially bypassing access controls or causing incorrect request routing. Response desynchronization may also occur, impacting the integrity of HTTP communications.
Mitigation Recommendations
Upgrade Apache bRPC to version 1.18.0, which includes an official fix rejecting the problematic HTTP header forms and properly handling chunked trailers. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3521. After applying the fix, the default behavior rejects the four problematic header forms and drops chunked trailers instead of merging them. Two compatibility flags (http_allow_obs_fold and http_strict_header_token) are available to restore legacy acceptance if necessary. No other mitigation is required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qgcc-7cgj-hmr3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-86146"]
- State
- PUBLISHED
Threat ID: 6ad91cd44d27ba8daafaa59e
Added to database: 10/21/2026, 20:13:08 UTC
Last enriched: 10/21/2026, 20:20:09 UTC
Last updated: 10/22/2026, 04:15:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.