apache/brpc vulnerabilities
CVEs whose affected-version data names the apache/brpc package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
35 CVEsRSS
CVE-2026-56387NoneApache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive …
CVE-2026-58064NoneApache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bR…
CVE-2026-56388NoneApache bRPC: Out-of-Bounds Write in Redis Command Parser
The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk st…
CVE-2026-56386High· 7.5Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-len…
CVE-2026-74755NoneApache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::a…
CVE-2026-61916NoneApache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by…
CVE-2026-54427NoneApache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a…
CVE-2026-78048NoneApache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a crafted sequence of HPA…
CVE-2026-74757NoneApache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge …
CVE-2026-61902NoneApache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an af…
CVE-2026-78058NoneApache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 …
CVE-2026-66392NoneApache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercep…
CVE-2026-79704NoneApache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly…
CVE-2026-78066NoneApache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive dis…
CVE-2026-74758NoneApache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is re…
CVE-2026-81755NoneApache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive n…
CVE-2026-78334NoneApache bRPC: Missing Authentication for Streaming RPC Frames
Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Auth…
CVE-2026-82210NoneApache bRPC: Remote denial of service (crash) via malformed stream feedback frames
Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame. Root Cause: When handling FRAME_TYPE_FE…
CVE-2026-80463NoneApache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to exhaust the memory of a server (denial of service) by sending an endless sequence of contin…
CVE-2026-82425NoneApache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service
A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. Root Cause: When a Socket with health checking enabled fails, Socket::WaitAndR…
CVE-2026-82231NoneApache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client …
CVE-2026-82230NoneApache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser (used to …
CVE-2026-84748NoneApache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internal_port is documented to make builtin services (and T…
CVE-2026-84747NoneApache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments
Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function Fi…
CVE-2026-82953NoneApache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command. Root Cause: When an RTMP…
CVE-2026-86146NoneApache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is …
CVE-2026-84727Medium· 5.4Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message
Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message. Root Cause: When processi…
CVE-2026-82942NoneApache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA w…
CVE-2026-87849NoneApache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose d…
CVE-2026-90484NoneApache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (…