228 matches found
Ashwesker-CVE-2025-60021
🛑 CVE-2025-60021 — Apache bRPC Remote Command Injection 📌 Overview CVE-2025-60021 is a critical remote command injection vulnerability found in the heap profiler built-in service /pprof/heap of Apache bRPC versions earlier than 1.15.0 , allowing unauthenticated attackers to run arbitrary OS...
CVE-2026-90484
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...
CVE-2026-86146
Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...
CVE-2026-86147
External control of file name or path and uncontrolled resource consumption in Apache bRPC version 1.18.0 on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the...
CVE-2026-87849
The Discovery naming-service reply parser in Apache bRPC versions 1.18.0 calls RapidJSON object-only accessors FindMember on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries...
CVE-2026-82231
A Thrift client in Apache bRPC version 1.18.0, built with WITHTHRIFT which is off by default can be crashed by the server peer it talks to. When the server returns a TEXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws...
CVE-2026-82425
A reachable assertion in Apache bRPC version 1.18.0 on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. Root Cause: When a Socket with health checking enabled fails, Socket::WaitAndReset closes its file descriptor while the event dispatcher may...
CVE-2026-82953
NULL pointer dereference in the RTMP protocol implementation in Apache bRPC version onfailid, causing the process to crash. Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream may return null i.e., the service rejects createStream requests. A remote client that sends a...
CVE-2026-84748
Improper authorization in Apache bRPC versions 1.18.0 on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internalport is documented to make builtin services and Tabbed services reachable only from the internal port, and the HTTP/...
CVE-2026-82942
A data race in the RDMA transport of Apache bRPC versions 1.18.0 allows a remote client to crash the server process denial of service when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server...
CVE-2026-84727
Use-after-free in the RTMP protocol implementation in Apache bRPC version RtmpChunkStream::SerializeMessage runs concurrently on sender threads and dereferences the same RtmpChunkStream object without synchronization. If a remote peer sends an Abort message naming a chunk stream that is...
CVE-2026-84747
Interpretation conflict in the HTTP protocol implementation in Apache bRPC version 1.18.0 on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function FindMethodPropertyByURI in bRPC's HTTP protocol splits the request...
CVE-2026-82230
Uncontrolled recursion in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser used to serve nsheadmcpack / ubrpc / publicpbrpc requests recursively pars...
CVE-2026-82210
Enforceable assertion in the streaming feature of Apache bRPC version 0 and unconditionally asserts CHECKbuf.IsEmpty on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled curbufsize == 0, reaches these...
EUVD-2026-107230
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...
CVE-2026-90484
The MySQL client response parser in Apache bRPC is vulnerable to a NULL pointer dereference when processing a zero-payload-length response packet from a server. The root cause resides in brpc::policy::MysqlReply::ConsumePartialIOBuf, where buf.fetch(header, 5) returns nullptr because the buffer o...
CVE-2026-90484 Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...
CVE-2026-90484 Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check isfullpackage, after which the parser reads the response type...
EUVD-2026-107229
The Discovery naming-service reply parser in Apache bRPC versions 1.18.0 calls RapidJSON object-only accessors FindMember on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries...