# Apache Software Foundation Apache bRPC. Every CVE that names Apache Software Foundation Apache bRPC among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash](https://agentprime.io/advisories/CVE-2026-90484.md) `CVE-2026-90484` · CVE record: Apache Software Foundation Apache bRPC · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing](https://agentprime.io/advisories/CVE-2026-87849.md) `CVE-2026-87849` · CVE record: Apache Software Foundation Apache bRPC · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth](https://agentprime.io/advisories/CVE-2026-86249.md) `CVE-2026-86249` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass - [Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof](https://agentprime.io/advisories/CVE-2026-86147.md) `CVE-2026-86147` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Denial of service - [Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing](https://agentprime.io/advisories/CVE-2026-86146.md) `CVE-2026-86146` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling - [Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration](https://agentprime.io/advisories/CVE-2026-84748.md) `CVE-2026-84748` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments](https://agentprime.io/advisories/CVE-2026-84747.md) `CVE-2026-84747` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-436 - [Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message](https://agentprime.io/advisories/CVE-2026-84727.md) `CVE-2026-84727` · CVE record: Apache Software Foundation Apache bRPC · CVSS 5.4 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service](https://agentprime.io/advisories/CVE-2026-82953.md) `CVE-2026-82953` · CVE record: Apache Software Foundation Apache bRPC · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service](https://agentprime.io/advisories/CVE-2026-82942.md) `CVE-2026-82942` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Race condition - [Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service](https://agentprime.io/advisories/CVE-2026-82425.md) `CVE-2026-82425` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client](https://agentprime.io/advisories/CVE-2026-82231.md) `CVE-2026-82231` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-248 - [Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser](https://agentprime.io/advisories/CVE-2026-82230.md) `CVE-2026-82230` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames](https://agentprime.io/advisories/CVE-2026-82210.md) `CVE-2026-82210` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request](https://agentprime.io/advisories/CVE-2026-81755.md) `CVE-2026-81755` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly](https://agentprime.io/advisories/CVE-2026-80463.md) `CVE-2026-80463` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling](https://agentprime.io/advisories/CVE-2026-79704.md) `CVE-2026-79704` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Apache bRPC: Missing Authentication for Streaming RPC Frames](https://agentprime.io/advisories/CVE-2026-78334.md) `CVE-2026-78334` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass - [Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes](https://agentprime.io/advisories/CVE-2026-78066.md) `CVE-2026-78066` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path](https://agentprime.io/advisories/CVE-2026-78058.md) `CVE-2026-78058` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service, Memory corruption - [Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder](https://agentprime.io/advisories/CVE-2026-78048.md) `CVE-2026-78048` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling](https://agentprime.io/advisories/CVE-2026-74758.md) `CVE-2026-74758` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count](https://agentprime.io/advisories/CVE-2026-74757.md) `CVE-2026-74757` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-74755.md) `CVE-2026-74755` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names](https://agentprime.io/advisories/CVE-2026-66392.md) `CVE-2026-66392` · CVE record: Apache Software Foundation Apache bRPC · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms](https://agentprime.io/advisories/CVE-2026-61916.md) `CVE-2026-61916` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits](https://agentprime.io/advisories/CVE-2026-61902.md) `CVE-2026-61902` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation](https://agentprime.io/advisories/CVE-2026-58064.md) `CVE-2026-58064` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Out-of-Bounds Write in Redis Command Parser](https://agentprime.io/advisories/CVE-2026-56388.md) `CVE-2026-56388` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service, Memory corruption, CWE-252 - [Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser](https://agentprime.io/advisories/CVE-2026-56387.md) `CVE-2026-56387` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser](https://agentprime.io/advisories/CVE-2026-56386.md) `CVE-2026-56386` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser](https://agentprime.io/advisories/CVE-2026-54427.md) `CVE-2026-54427` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser](https://agentprime.io/advisories/CVE-2026-54426.md) `CVE-2026-54426` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding](https://agentprime.io/advisories/CVE-2026-54425.md) `CVE-2026-54425` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests](https://agentprime.io/advisories/CVE-2026-48830.md) `CVE-2026-48830` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass - [Apache bRPC: Remote command injection vulnerability in heap builtin service](https://agentprime.io/advisories/CVE-2025-60021.md) `CVE-2025-60021` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 16 Jan 2026 · Tags: Command injection - [Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser](https://agentprime.io/advisories/CVE-2025-59789.md) `CVE-2025-59789` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 1 Dec 2025 · Tags: Denial of service - [Apache bRPC: Redis Parser Remote Denial of Service](https://agentprime.io/advisories/CVE-2025-54472.md) `CVE-2025-54472` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 14 Aug 2025 · Tags: Memory corruption, Denial of service - [Apache bRPC: HTTP request smuggling vulnerability](https://agentprime.io/advisories/CVE-2024-23452.md) `CVE-2024-23452` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 8 Feb 2024 · Tags: HTTP request smuggling - [Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability](https://agentprime.io/advisories/CVE-2023-45757.md) `CVE-2023-45757` · CVE record: Apache Software Foundation Apache bRPC · No CVSS score · Not analysed yet · Published 16 Oct 2023 · Tags: Cross-site scripting (XSS) - [Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution](https://agentprime.io/advisories/CVE-2023-31039.md) `CVE-2023-31039` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2023 · Tags: CWE-20 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .