Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.
Root Cause:
The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.
Affected Scenarios:
Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3499
Note:
No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.
Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.
Root Cause:
When handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service.
Affected Scenarios:
Use bRPC server with the streaming control feature (Stream API) served from untrusted network.
How to Fix:
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3494
The fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.
e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse_str() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.
CVE-2026-81755 is an uncontrolled resource consumption vulnerability in Apache bRPC versions prior to 1.18.0. It affects the streaming RPC component, where a remote attacker can send a single RPC request declaring an excessive number of streams. This causes the server to allocate excessive memory and resources, leading to denial of service. The vulnerability arises because the server does not limit the number of streams accepted per request. The issue is fixed in version 1.18.0 by introducing a configurable limit on streams per request.
Apache bRPC versions prior to 1.18.0 contain a vulnerability where unbounded memory accumulation occurs in the stream message reassembly process. Remote attackers can exploit this by sending an endless sequence of continuation data frames, causing the server to exhaust memory and potentially crash or become unavailable. The issue arises because fragmented stream messages accumulate continuation frames without limits, and default flow-control settings do not throttle the sending rate. The vulnerability affects services accepting streams from untrusted clients using the built-in streaming protocol. The issue is fixed in version 1.18.0 by limiting the accumulated payload to max_body_size (default 64MB), closing streams that exceed this limit with an error. Adjusting max_body_size is possible to accommodate legitimate large messages.
CVE-2026-79704 is an out-of-bounds read vulnerability in Apache bRPC's streaming RPC client versions 1.11.0 through 1.17.0. The flaw occurs when a client creates multiple streams in a single RPC and the server response contains fewer extra_stream_ids than expected. This mismatch leads to an out-of-bounds read, potentially causing client crashes (denial of service) or unintended memory disclosure. The issue affects clients connecting to untrusted or malicious servers or networks. The vulnerability is fixed in version 1.18.0, which rejects malformed responses.
Apache bRPC versions prior to 1.18.0 have a missing authentication vulnerability in the streaming RPC path. This flaw allows remote attackers to bypass server authentication and inject or deliver streaming frames when the server is configured with an Authenticator. The issue arises because streaming RPC frames bypass the authentication hook, enabling unauthenticated peers to exchange frames. The vulnerability affects servers configured with authentication that serve streaming RPC from untrusted networks or where foreign connections can impersonate streams by ID. The issue is fixed in version 1.18.0.
CVE-2026-78066 is a resource exhaustion vulnerability in Apache bRPC versions prior to 1.18.0. Multiple parsers accept wire-controlled input without limiting declared sizes or decompressed output, allowing attackers to cause excessive memory consumption and crash the service. The issue affects gzip/zlib/snappy decompressors, AMF string readers, RTMP chunk headers, sofa-pbrpc parser, and mcpack2pb message handling. The vulnerability is fixed in version 1.18.0, which enforces limits on decompressed sizes and message lengths.
CVE-2026-78058 is an uncontrolled resource consumption vulnerability in Apache bRPC versions prior to 1.18.0 affecting the HTTP/2 receive path. It allows remote unauthenticated attackers to crash the server or cause unbounded memory growth by sending crafted HTTP/2 frames. The issue arises because the server does not enforce advertised HTTP/2 receive-side limits, leading to excessive resource use.
CVE-2026-78048 is a reachable-assertion vulnerability in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC versions before 1.18.0. This flaw allows a remote attacker to crash the server by sending a crafted sequence of HPACK headers, causing a denial of service. The issue arises from incorrect sizing of the dynamic-table ring buffer, which leads to an assertion failure during header processing. The vulnerability affects bRPC servers handling HTTP/2 or gRPC requests from untrusted networks. A fix is available in version 1.18.0 or via a specific patch.
CVE-2026-74758 is a heap use-after-free vulnerability in the RTMP protocol component of Apache bRPC versions prior to 1.18.0. It allows a remote attacker to crash a bRPC RTMP server by sending a specially crafted Abort control message without requiring authentication. The issue arises because the server deletes a chunk stream object while it is still being accessed, leading to use-after-free conditions.
CVE-2026-74757 is a resource allocation vulnerability in Apache bRPC versions prior to 1.18.0. The mcpack2pb component improperly trusts the item count in an mcpack array header without validating it against the actual payload size. This allows remote attackers to cause the server to allocate excessive memory by sending a crafted request with a very large array item count, potentially leading to process termination due to memory exhaustion.
An integer underflow vulnerability exists in Apache bRPC versions before 1.18.0 in the mcpack2pb component. This flaw allows remote attackers to crash a bRPC server by sending a specially crafted request with a string field having a zero value_size. The vulnerability arises because the UnparsedValue::as_string() function subtracts one from the value_size without validating it, causing an underflow and an uncaught exception that aborts the process. Default server configurations are typically not affected, but certain deployment patterns using nshead frames with the ubrpc mcpack2 adaptor are vulnerable.
CVE-2026-114242 is a medium severity SQL injection vulnerability in the dhikshitha29 Insurance-Management-System. The flaw exists in the mysqli_query function within the /Admin/View/editPlan.php file, where manipulation of the Plan_no or Name parameters can lead to SQL injection. The vulnerability can be exploited remotely without authentication. The product uses a rolling release model, so specific affected or fixed versions are not available. The vendor has been notified but has not yet responded or issued a fix. Public exploit code is available, though no active exploitation in the wild has been reported.
Apache bRPC versions before 1.18.0 have a vulnerability where the client TLS peer verification validates the server certificate chain but does not verify that the certificate matches the expected DNS name or IP address. This allows a network attacker with a valid certificate for a different name to impersonate the intended TLS endpoint. The issue is fixed in version 1.18.0 by enabling proper hostname verification during the TLS handshake.
CVE-2026-61916 is an out-of-bounds read vulnerability in Apache bRPC before version 1.18.0 affecting platforms where plain char is unsigned, such as ARM64. The flaw arises from improper handling of high-bit bytes in URL parsing and case-insensitive header lookup, allowing remote attackers to cause a process crash and denial of service by sending crafted input. The issue does not affect builds where plain char is signed, such as x86_64. The vulnerability is fixed in Apache bRPC version 1.18.0 and later.
Apache bRPC versions before 1.18.0 have a vulnerability where the max_body_size limit is not consistently enforced during certain HTTP and response parsing operations. This allows a remote unauthenticated attacker to cause excessive memory consumption, potentially leading to denial of service. The issue is fixed in version 1.18.0, which properly rejects oversized HTTP bodies and responses.
CVE-2026-58064 is a vulnerability in Apache bRPC's Redis protocol implementation where inline command parsing allocates and copies the entire connection buffer before a complete CRLF-terminated command is received. This allows a remote attacker to send long inline inputs without a terminating CRLF, causing increased memory usage and CPU overhead, potentially leading to denial of service. The issue arises because the redis_max_allocation_size limit was not effectively applied to inline commands before allocation. The vulnerability affects Apache bRPC versions prior to 1.18.0. The issue is fixed in version 1.18.0 by applying the allocation limit to inline commands and rejecting lines exceeding this limit.
CVE-2026-56388 is an out-of-bounds write vulnerability in Apache bRPC's Redis server command parser. It occurs when the parser accepts an empty RESP array as a command header, allowing a remote unauthenticated attacker to cause a crash by sending a malformed command. The issue affects deployments with Redis service enabled that accept Redis protocol traffic from untrusted clients. The vulnerability is fixed in bRPC version 1.18.0.
CVE-2026-56387 is a vulnerability in Apache bRPC's RTMP AMF parser where untrusted input can specify excessive string lengths or array counts, leading to excessive memory allocation or resource consumption. This affects deployments with the bRPC RTMP server enabled and accepting RTMP traffic from untrusted clients. The issue is fixed in Apache bRPC version 1.18.0 by introducing configurable limits on AMF string size and array element count.