EUVD-2026-107184

Uncontrolled resource consumption in the HTTP/2 h2 receive path of Apache bRPC version 1.18.0 on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRP...

CVE-2026-78058

Apache bRPC (version

CVE-2026-78048 Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 h2/gRPC stack in Apache bRPC version = 1 byte + value = 1 byte + 32 bytes of overhead. However, RFC 7541 section 4.1 specifies that the minimum entry size is 33 bytes, because the value may be empty name = 1 byte +...

EUVD-2026-107183

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 h2/gRPC stack in Apache bRPC version = 1 byte + value = 1 byte + 32 bytes of overhead. However, RFC 7541 section 4.1 specifies that the minimum entry size is 33 bytes, because the value may be empty name = 1 byte +...

CVE-2026-78048

Apache bRPC versions prior to 1.18.0 are vulnerable to a Remote Denial of Service (DoS) via a reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack. The root cause is located in src/brpc/details/hpack.cpp, where the IndexTable::Init function incorrectly as...

CVE-2026-74758 Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling

A heap use-after-free in the RTMP protocol component of Apache bRPC versions 1.18.0 allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: When an RTMP Abort control message names the...

CVE-2026-74758

Apache bRPC (versions

EUVD-2026-107182

A heap use-after-free in the RTMP protocol component of Apache bRPC versions 1.18.0 allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: When an RTMP Abort control message names the...

CVE-2026-74757

Apache bRPC (versions

EUVD-2026-107181

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts t...

CVE-2026-74757 Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts t...

CVE-2026-74755 Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service

An integer underflow in the mcpack2pb component of Apache bRPC version 1.18.0 on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero valuesize. The UnparsedValue::asstring function computes size - 1 without validating size; when...

EUVD-2026-107180

An integer underflow in the mcpack2pb component of Apache bRPC version 1.18.0 on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero valuesize. The UnparsedValue::asstring function computes size - 1 without validating size; when...

CVE-2026-74755

Apache bRPC (versions prior to 1.18.0 ) is vulnerable to a Denial of Service due to an integer underflow in the mcpack2pb component. The UnparsedValue::as_string() function in src/mcpack2pb/parser.cpp fails to validate the value_size of string fields from network data; when the size is 0, the cal...

EUVD-2026-107178

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a C...

CVE-2026-66392 Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a C...

CVE-2026-66392

Apache bRPC versions before 1.18.0 are vulnerable to a TLS certificate validation flaw. While the library validates the server certificate chain when client TLS peer verification is enabled, it fails to bind the certificate to an expected DNS name or IP address . This allows a network attacker wh...

EUVD-2026-107177

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit se...

CVE-2026-61916 Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit se...

CVE-2026-61916

Apache bRPC versions before 1.18.0 are vulnerable to an out-of-bounds read in URL parsing and case-insensitive header lookups on platforms where plain char is unsigned (e.g., ARM64 ). The root cause is the failure to normalize input bytes to a signed-char range before accessing biased 256-entry l...