Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass… (CVE-2026-84747)

The vulnerability arises from the method dispatch function FindMethodPropertyByURI() in Apache bRPC's HTTP protocol implementation, which splits request paths by skipping empty segments. Paths with consecutive slashes (e.g., //flags, /flags//) are treated as equivalent to their collapsed form (/flags), violating RFC 3986 that treats these as distinct. Front proxies enforcing ACLs on literal paths only block the collapsed form, allowing padded paths to bypass restrictions. Furthermore, the HTTP/2 implementation fails to validate the :path pseudo-header properly, accepting requests without a valid :path as per RFC 9113. This enables attackers to access builtin services or resources that should be blocked by the front proxy. The issue is resolved in bRPC 1.18.0, which rejects paths with empty segments and invalid HTTP/2 :path headers by default.

Remote attackers can bypass access control rules enforced by front proxies that filter requests based on literal paths, allowing unauthorized access to restricted resources or builtin services in Apache bRPC deployments behind such proxies. This can lead to exposure of sensitive internal services or data that the proxy intended to block. The HTTP/2 validation flaw further increases the risk by accepting malformed requests that should be rejected.

Upgrade Apache bRPC to version 1.18.0, which includes the fix for this vulnerability. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3512. After applying the fix, the server rejects HTTP and HTTP/2 request paths containing empty path segments and invalid :path pseudo-headers by default. Deployments requiring previous lenient behavior can re-enable it via the gflag -http_allow_empty_path_segments, but this is not recommended for servers exposed to untrusted traffic.