CVE-2026-61916None▾ SunlitOut-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit set.
Root Cause: Two 256-entry lookup tables are accessed through pointers biased by 128 so that valid indices are in the range -128 to 127. Input bytes are promoted from plain char to int without first normalizing them to the signed-char range. On affected platforms, bytes in the range 0x80 to 0xFF therefore become indices 128 to 255 and read up to 127 bytes beyond the end of the underlying tables.
Affected Scenarios: A remotely accessible bRPC HTTP server on an affected platform can reach the vulnerable URL lookup through an unauthenticated request URI containing a high-bit byte. The case-insensitive lookup is also reachable when untrusted header names are processed through APIs such as the HTTP/2 HPACK path. HTTP/1 header names containing high-bit bytes are rejected by the HTTP/1 parser before reaching the vulnerable lookup. Builds where plain char is signed, which commonly include x86_64 builds, are not affected by this issue.
How to Fix: Choose one of the following options:
The fix normalizes lookup-table indices to the signed-char range before accessing the biased tables.
apache/brpc < 1.18.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56386High· 7.5Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
CVE-2026-79704NoneApache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
CVE-2026-87849NoneApache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
CVE-2026-56387NoneApache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
CVE-2026-56388NoneApache bRPC: Out-of-Bounds Write in Redis Command Parser
CVE-2026-58064NoneApache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation