PT-2026-120541

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 h2/gRPC stack in Apache bRPC version = 1 byte + value = 1 byte + 32 bytes of overhead. However, RFC 7541 section 4.1 specifies that the minimum entry size is 33 bytes, because the value may be empty name = 1 byte +...

PT-2026-120559

A Thrift client in Apache bRPC version 1.18.0, built with WITH THRIFT which is off by default can be crashed by the server peer it talks to. When the server returns a T EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws...

PT-2026-120565

Improper authorization in Apache bRPC versions 1.18.0 on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internal port is documented to make builtin services and Tabbed services reachable only from the internal port, and the...

PT-2026-120536

Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit se...

PT-2026-120538

An integer underflow in the mcpack2pb component of Apache bRPC version 1.18.0 on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value size. The UnparsedValue::as string function computes size - 1 without validating size; whe...

PT-2026-120546

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

PT-2026-120567

External control of file name or path and uncontrolled resource consumption in Apache bRPC version 1.18.0 on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the...

PT-2026-120562

NULL pointer dereference in the RTMP protocol implementation in Apache bRPC version onfail id, causing the process to crash. Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream may return null i.e., the service rejects createStream requests. A remote client that sends ...

PT-2026-120528

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK...

PT-2026-120530

Uncontrolled recursion in the AMF parser in Apache bRPC 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack. Affected...

PT-2026-120560

A reachable assertion in Apache bRPC version 1.18.0 on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. Root Cause: When a Socket with health checking enabled fails, Socket::WaitAndReset closes its file descriptor while the event dispatcher may...

PT-2026-120533

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...

Apache bRPC buffer error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a buffer error vulnerability. This vulnerability arises because the Discovery naming service reply parser fails to validate whether JSON values represent objects before invoking the RapidJSON accessor, which is designed solely for objects. When...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the stream message reassembly path does not limit the cumulative size of fragmented messages upon resending them. Remote attackers can send an infinite stream of resending...

Apache bRPC encryption issue vulnerability

Versions of Apache bRPC prior to 1.18.0 contain an encryption-related vulnerability. This vulnerability arises when client-side TLS peer verification is enabled but certificates are not bound to the expected DNS name or IP address. As a result, network attackers capable of redirecting or...

Apache bRPC buffer error vulnerability

A security vulnerability exists in Apache bRPC versions prior to 1.18.0. This vulnerability stems from integer underflow and out-of-bounds reads during the parsing of HTTP/2 DATA frames, potentially allowing unauthenticated remote attackers to send malformed DATA frames and induce a...

Improper handling of exceptions in Apache bRPC

Versions of Apache bRPC prior to 1.18.0 contain an improper exception handling vulnerability. This vulnerability stems from an error in calculating the number of slots within the dynamic table’s circular buffer for HPACK header compression decoding; it fails to account for a minimum of 33 bytes p...

Improper handling of exceptions in Apache bRPC

Versions of Apache bRPC prior to 1.18.0 contain an improper exception handling vulnerability. This vulnerability arises because the Thrift client fails to catch exceptions thrown by Apache Thrift when decoding malformed TException responses returned by the server. As a result, these exceptions ar...

PT-2026-120568

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal port, the HTTP built-in service exemption on internal port can be abused to bypass authentication entirely. VerifyHttpRequest returns true without checking any credential when a built-in service is requested on interna...

PT-2026-120542

Uncontrolled resource consumption in the HTTP/2 h2 receive path of Apache bRPC version 1.18.0 on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRP...