PT-2026-120543

Resource exhaustion in Apache bRPC version 1.18.0 on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1 Th...

PT-2026-120570

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check is full package, after which the parser reads the response ty...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a security vulnerability. This vulnerability arises because the HTTP/2 h2 receive path fails to enforce endpoint restrictions such as SETTINGSMAXCONCURRENTSTREAMS and SETTINGSMAXHEADERLISTSIZE. As a result, write limits on control frames are bypasse...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the Redis reply parser fails to limit recursion depth; as a result, remote peers on the Redis server return deeply nested RESP array replies, potentially causing the bRPC...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the HTTP/2 HPACK decoder fails to limit recursion depth. Remote attackers can exploit this by sending specially crafted HTTP/2 header blocks containing numerous consecutive...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises from the failure to consistently enforce the configured maxbodysize limit during non-persistent HTTP/1 and HTTP/2 parsing, as well as in parsing responses from memcache and...

Improper handling of exceptions in Apache bRPC

A security vulnerability exists in Apache bRPC versions prior to 1.18.0. It arises because the Redis service command parser accepts an empty RESP array as a command header. A remote unauthenticated attacker can send an empty array header along with subsequent bulk strings to a bRPC server running...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the RTMP AMF parser directly accepts untrusted input: the length of AMF strings and the count of array elements are unchecked. Before validating byte counts within the...

Apache bRPC authorization issue vulnerability

Versions of Apache bRPC prior to 1.18.0 contain an authorization issue vulnerability. This vulnerability arises because the streaming RPC path lacks authentication; streaming RPC frames are consumed directly by ParseStreamingMessage without passing through the InputMessenger’s authentication hook...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability stems from uncontrolled recursion in the AMF parser; when processing nested AMF containers, there is no enforced limit on recursion depth. Remote RTMP endpoints sending deeply nested AMF...

Apache bRPC authorization issue vulnerability

Versions of Apache bRPC prior to 1.18.0 contain an authorization issue vulnerability. This vulnerability arises when ServerOptions.auth and ServerOptions.internalport are set simultaneously; the HTTP built-in service on internalport can then be exploited. Upon receiving authentication for the fir...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability stems from heap reuse after heap deallocation in the RTMP protocol component. Remote attackers can send specially crafted Abort control messages without authentication, causing the bRPC...

Vulnerability related to Apache bRPC race condition issues

Versions of Apache bRPC prior to 1.18.0 contain a race condition vulnerability. This vulnerability stems from data race issues during RDMA transmissions; the TCP fd input stream and the RDMA QP input stream share state variables such as Socket::readbuf without synchronization. As a result, an...

Apache bRPC authorization issue vulnerability

Apache bRPC versions 1.17.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from improper authentication; remote unauthenticated attackers can send built-in HTTP requests on the same HTTP/1.1 keep-alive connection, thereby bypassing authentication for protected...

Apache bRPC authorization issue vulnerability

Versions of Apache bRPC prior to 1.18.0 contain an authorization issue vulnerability. This vulnerability stems from improper authorization checks; certain protobuf-based protocol distribution paths fail to enforce restrictions defined by the securitymode flag. As a result, remote attackers can...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because multiple parsers fail to enforce limits on the size and decompression output declared by clients, potentially leading to disproportionate memory usage and process crashes...

Improper handling of exceptions in Apache bRPC

Versions of Apache bRPC prior to 1.18.0 contain an improper exception handling vulnerability. This vulnerability arises from a failure in assertion checks regarding the payload of feedback frames during the processing of FRAMETYPEFEEDBACK frames by the streaming functionality. Unauthenticated...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the streaming RPC component fails to limit the number of streams declared in streamsettings.extrastreamids within a single RPC request. Remote attackers can send requests...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a security vulnerability. This vulnerability arises because the built-in /flags service can be manipulated via ?setvalue= to alter the bvar/mbvar dump path; additionally, the bvardumptabs path is not properly sanitized. As a result, remote attackers...

Improper handling of exceptions in Apache bRPC

Versions of Apache bRPC prior to 1.18.0 contain an improper exception handling vulnerability. This vulnerability arises because a Socket enabled for health checks may still process input events after closing its file descriptors. When the health check resurrects the Socket, the file descriptor...