PT-2026-120565

Improper authorization in Apache bRPC versions 1.18.0 on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internal port is documented to make builtin services and Tabbed services reachable only from the internal port, and the...

PT-2026-120566

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

PT-2026-120569

The Discovery naming-service reply parser in Apache bRPC versions 1.18.0 calls RapidJSON object-only accessors FindMember on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries...

PT-2026-120532

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessiv...

PT-2026-120533

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...

PT-2026-120536

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit se...

PT-2026-120544

Missing authentication in the streaming RPC path of Apache bRPC version 1.18.0 on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured,...

PT-2026-120546

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

PT-2026-120558

Uncontrolled recursion in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser used to serve nshead mcpack / ubrpc / public pbrpc requests recursively...

PT-2026-120563

Use-after-free in the RTMP protocol implementation in Apache bRPC version RtmpChunkStream::SerializeMessage runs concurrently on sender threads and dereferences the same RtmpChunkStream object without synchronization. If a remote peer sends an Abort message naming a chunk stream that is...

PT-2026-120529

Uncontrolled recursion in the Redis reply parser in Apache bRPC 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit. The fix adds a...

PT-2026-120534

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminati...

PT-2026-120538

An integer underflow in the mcpack2pb component of Apache bRPC version 1.18.0 on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value size. The UnparsedValue::as string function computes size - 1 without validating size; whe...

PT-2026-120541

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 h2/gRPC stack in Apache bRPC version = 1 byte + value = 1 byte + 32 bytes of overhead. However, RFC 7541 section 4.1 specifies that the minimum entry size is 33 bytes, because the value may be empty name = 1 byte +...

PT-2026-120547

Uncontrolled resource consumption in the streaming RPC component of Apache bRPC version 1.18.0 allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root Cause: In the streaming RPC feature, a...

PT-2026-120557

Enforceable assertion in the streaming feature of Apache bRPC version 0 and unconditionally asserts CHECKbuf.IsEmpty on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled cur buf size == 0, reaches these...

PT-2026-120560

A reachable assertion in Apache bRPC version 1.18.0 on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. Root Cause: When a Socket with health checking enabled fails, Socket::WaitAndReset closes its file descriptor while the event dispatcher may...

PT-2026-120564

Interpretation conflict in the HTTP protocol implementation in Apache bRPC version 1.18.0 on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function FindMethodPropertyByURI in bRPC's HTTP protocol splits the request...

PT-2026-120567

External control of file name or path and uncontrolled resource consumption in Apache bRPC version 1.18.0 on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the...

Ashwesker-CVE-2025-60021

🛑 CVE-2025-60021 — Apache bRPC Remote Command Injection 📌 Overview CVE-2025-60021 is a critical remote command injection vulnerability found in the heap profiler built-in service /pprof/heap of Apache bRPC versions earlier than 1.15.0 , allowing unauthenticated attackers to run arbitrary OS...