PT-2026-120560

A reachable assertion in Apache bRPC version 1.18.0 on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. Root Cause: When a Socket with health checking enabled fails, Socket::WaitAndReset closes its file descriptor while the event dispatcher may...

PT-2026-120544

Missing authentication in the streaming RPC path of Apache bRPC version 1.18.0 on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured,...

PT-2026-120559

A Thrift client in Apache bRPC version 1.18.0, built with WITH THRIFT which is off by default can be crashed by the server peer it talks to. When the server returns a T EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws...

PT-2026-120540

A heap use-after-free in the RTMP protocol component of Apache bRPC versions 1.18.0 allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: When an RTMP Abort control message names the...

PT-2026-120529

Uncontrolled recursion in the Redis reply parser in Apache bRPC 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a...

PT-2026-120535

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max body size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured...

PT-2026-120542

Uncontrolled resource consumption in the HTTP/2 h2 receive path of Apache bRPC version 1.18.0 on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRP...

PT-2026-120539

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts t...

PT-2026-120528

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK...

PT-2026-120566

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

PT-2026-120530

Uncontrolled recursion in the AMF parser in Apache bRPC 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack. Affected...

PT-2026-120531

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

PT-2026-120532

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessiv...

PT-2026-120543

Resource exhaustion in Apache bRPC version 1.18.0 on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1 Th...

PT-2026-120545

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra stream id for every additional stream. The response...

PT-2026-120562

NULL pointer dereference in the RTMP protocol implementation in Apache bRPC version onfail id, causing the process to crash. Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream may return null i.e., the service rejects createStream requests. A remote client that sends ...

PT-2026-120527

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...

PT-2026-120533

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...

PT-2026-120570

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check is full package, after which the parser reads the response ty...

PT-2026-120567

External control of file name or path and uncontrolled resource consumption in Apache bRPC version 1.18.0 on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the...