---
id: CVE-2026-86147
title: >-
  Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded
  profiling duration via /pprof
summary: >-
  External control of file name or path and uncontrolled resource consumption in
  Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who
  can reach the builtin service port to create directories and
  truncate/overwrite fi…
severity: none
cwe:
  - CWE-73
  - CWE-400
vendor: Apache Software Foundation
product: apache/brpc
affected:
  - apache/brpc < 1.18.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:16:22.369Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86147'
references:
  - url: 'https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb'
tags:
  - cve.org
ingestedAt: '2026-10-21T12:48:53.754Z'
---

## Overview

External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the process-wide CPU/contention profiler for an arbitrarily long time.

Root Cause:
1. The builtin /flags service allows gflags carrying a validator to be modified at runtime via ?setvalue=. The bvar/mbvar dump path gflags (bvar_dump_file, bvar_dump_tabs, mbvar_dump_file) were registered with an accept-anything validator whose only purpose was to wake the dumping thread. A remote attacker could therefore repoint the dump path (e.g. GET /flags/bvar_dump_file?setvalue=/victim/dir/target followed by GET /flags/bvar_dump?setvalue=true, or the equivalent for mbvar_dump_file, which is used verbatim without a forced suffix), making the dumping thread recursively create directories and open/truncate files at attacker-chosen locations. Tab names in bvar_dump_tabs were appended to the path without sanitization, allowing '..' to escape the configured directory.
2. The /pprof builtin service did not clamp the ?seconds= parameter to FLAGS_max_profiling_seconds (a limit that /hotspots enforced). A single request such as ?seconds=2147483647 made the handler sleep for decades while holding the process-wide gperftools CPU profiler or bthread contention profiler, so /hotspots/cpu and /hotspots/contention returned 503 for everyone else during that time.

Affected Scenarios:
Any Apache bRPC server exposing the builtin services (enabled by default on the same port as normal RPC traffic) to untrusted networks.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch:  https://github.com/apache/brpc/pull/3523 

Note:
After the fix, bvar_dump_file, bvar_dump_tabs and mbvar_dump_file can no longer be modified at runtime through the /flags builtin service. They can still be changed programmatically via google::SetCommandLineOption(), taking effect on the next dump cycle. The profiling duration of /pprof is now capped by the -max_profiling_seconds gflag (default 300 seconds), which can be adjusted by the server owner.

## Affected

- `apache/brpc < 1.18.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.