Threat Intelligence Database

CVE-2026-90484 is a null pointer dereference vulnerability in the MySQL client response parser of Apache bRPC. The issue occurs when the server sends a zero-payload-length response packet, which the client incorrectly processes, leading to a crash. This can cause denial of service for clients connecting to malicious or compromised MySQL servers. The vulnerability is fixed in Apache bRPC version 1.18.0.

CVE-2026-87849 is an out-of-bounds read vulnerability in Apache bRPC versions prior to 1.18.0. The issue arises because the Discovery naming-service reply parser calls RapidJSON object-only accessors on JSON values without verifying that those values are objects. Malformed Discovery responses with non-object entries can cause the bRPC client to read memory out of bounds and potentially crash.

CVE-2026-86249 is an improper authentication vulnerability in Apache bRPC versions prior to 1.18.0. It occurs when a server sets both ServerOptions.auth and ServerOptions.internal_port, allowing an attacker to bypass authentication by exploiting the HTTP built-in service exemption on the internal port. This flaw lets an attacker authenticate the entire connection by sending a request to the internal port, after which subsequent requests on the same connection bypass credential checks. The issue is fixed in version 1.18.0, which restricts internal_port to only built-in and Tabbed services and rejects ordinary service requests with HTTP 403.

Apache bRPC versions prior to 1.18.0 contain vulnerabilities allowing remote attackers to control file paths and cause resource exhaustion. Attackers can exploit the builtin /flags service to create directories and overwrite files with server process privileges by manipulating dump path flags. Additionally, the /pprof service allows unbounded profiling durations, potentially causing denial of service by holding profiling resources indefinitely. These issues affect any bRPC server exposing builtin services to untrusted networks.

CVE-2026-86146 is a vulnerability in Apache bRPC versions prior to 1.18.0 involving inconsistent interpretation of HTTP/1.1 requests between bRPC and front-end proxies or load balancers. This inconsistency allows remote attackers to perform HTTP request/response smuggling by exploiting differences in header parsing, such as spaces before colons, interior spaces in Content-Length values, obsolete line folding, and chunked trailer handling. The issue can lead to request smuggling, header injection, and response desynchronization. Apache bRPC 1.18.0 fixes this vulnerability by rejecting these problematic header forms and changing how chunked trailers are processed.

Apache bRPC versions prior to 1.18.0 contain an improper authorization vulnerability that allows remote attackers to access builtin services through the public port. This occurs because protobuf-based protocol dispatch paths do not enforce the intended security_mode flag, enabling unauthorized invocation of builtin services that expose sensitive runtime information. The issue affects configurations where the internal_port is set to restrict builtin services, but the public port remains reachable from untrusted networks with any protobuf-based protocol enabled.

Apache bRPC versions prior to 1.18.0 contain an interpretation conflict in HTTP path handling that allows remote attackers to bypass access control rules enforced by a front proxy. This occurs because the server collapses consecutive slashes in request paths, treating distinct paths as equivalent, contrary to RFC 3986. Additionally, the HTTP/2 implementation fails to validate the :path pseudo-header properly, allowing malformed requests. These issues enable attackers to access resources that the front proxy intended to block.

Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message. Root Cause: When processing an RTMP Abort (protocol control message type 2), the RTMP policy implementation deleted the target RtmpChunkStream object. The send path (RtmpUnsentMessage::AppendAndDestroySelf -> RtmpChunkStream::SerializeMessage) runs concurrently on sender threads and dereferences the same RtmpChunkStream object without synchronization. If a remote peer sends an Abort message naming a chunk stream that is concurrently being used to serialize an outgoing message, the stream object is freed while still in use, resulting in a use-after-free. Additionally, deleting the chunk stream discarded its previous message header, so subsequent compressed (type-3) chunk headers on that stream could no longer be decoded. Affected Scenarios: Any application using the bRPC RTMP protocol implementation (rtmp policy), either as an RTMP server or as an RTMP client, where the remote endpoint is untrusted. The attacker needs to send an Abort message targeting a chunk stream id that is concurrently used for sending, which can crash the process or lead to memory corruption. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3515

A NULL pointer dereference vulnerability exists in Apache bRPC's RTMP protocol implementation prior to version 1.18.0. This flaw allows remote attackers to cause a denial of service by crashing the server when a crafted createStream command is sent and the client closes the connection prematurely. The issue arises when the server rejects a createStream request, returns a null stream, and then attempts to access a member of the null pointer during error handling.

A race condition vulnerability (CWE-362) exists in Apache bRPC versions prior to 1.18.0 when RDMA support is enabled. This flaw allows a remote unauthenticated client to cause a denial of service by crashing the server process due to improper synchronization of shared input buffers during RDMA handshake and message processing. The issue occurs only if the server is built and run with RDMA enabled and accepts connections from untrusted clients. Upgrading to version 1.18.0 or applying the provided patch mitigates the vulnerability.