6 matches found
CVE-2024-23452
Apache bRPC’s HTTP server (versions 0.9.5–1.7.0) is affected by a request-smuggling issue caused by non-compliance of the http_parser with RFC 7230 when handling messages with both Transfer-Encoding and Content-Length. In the described scenario, a frontend server using TE can cause a backend bRPC...
CVE-2025-60021
A critical remote command injection vulnerability exists in the Apache bRPC heap profiler built-in service (/pprof/heap) for all versions prior to 1.15.0 . The root cause is the lack of validation for the user-provided extra_options parameter, which the service executes as a command-line argument...
CVE-2023-31039
CVE-2023-31039 affects Apache bRPC prior to 1.5.0. The vulnerability arises from the ServerOptions::pid_file parameter, which, if influenced at startup, enables arbitrary code execution with the bRPC process permissions. Affected: brpc
CVE-2025-59789
Apache bRPC (versions prior to 1.15.0 ) is vulnerable to a stack overflow Denial of Service (DoS) due to uncontrolled recursion in the json2pb component. The root cause is that the underlying rapidjson parser uses a recursive method by default; providing deep recursive JSON data from an untrusted...
CVE-2023-45757
CVE-2023-45757 affects Apache bRPC 1.6.0 (e.g., 1.6.1), (2) apply the patch from PR #2411 if upgrading is difficult, or (3) disable the rpcz feature. If exploitation details or in-the-wild data are not present in the provided documents, those specifics are not stated here.