Advisories · Technology

Apache Software Foundation Apache bRPC.

Every CVE that names Apache Software Foundation Apache bRPC among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-90484 CVE record

CVSS 6.5 Medium

Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
- Apache Software Foundation Apache bRPC
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-87849 CVE record

CVSS 4.3 Medium

Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
- Apache Software Foundation Apache bRPC
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-86249 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
- Apache Software Foundation Apache bRPC
- Authentication bypass
Not analysed yet 21 Oct 2026
CVE-2026-86147 CVE record

CVSS 7.5 High

Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
- Apache Software Foundation Apache bRPC
- Path traversal
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-86146 CVE record

CVSS 7.5 High

Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
- Apache Software Foundation Apache bRPC
- HTTP request smuggling
Not analysed yet 21 Oct 2026
CVE-2026-84748 CVE record

CVSS 7.5 High

Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
- Apache Software Foundation Apache bRPC
- Broken access control
Not analysed yet 21 Oct 2026
CVE-2026-84747 CVE record

CVSS 7.5 High

Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments
- Apache Software Foundation Apache bRPC
- CWE-436
Not analysed yet 21 Oct 2026
CVE-2026-84727 CVE record

CVSS 5.4 Medium

Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message
- Apache Software Foundation Apache bRPC
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-82953 CVE record

CVSS 5.3 Medium

Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
- Apache Software Foundation Apache bRPC
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-82942 CVE record

CVSS 7.5 High

Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
- Apache Software Foundation Apache bRPC
- Race condition
Not analysed yet 21 Oct 2026
CVE-2026-82425 CVE record

CVSS 7.5 High

Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-82231 CVE record

CVSS 7.5 High

Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
- Apache Software Foundation Apache bRPC
- CWE-248
Not analysed yet 21 Oct 2026
CVE-2026-82230 CVE record

CVSS 7.5 High

Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-82210 CVE record

CVSS 7.5 High

Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-81755 CVE record

CVSS 7.5 High

Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-80463 CVE record

CVSS 7.5 High

Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-79704 CVE record

CVSS 7.5 High

Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
- Apache Software Foundation Apache bRPC
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-78334 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache bRPC: Missing Authentication for Streaming RPC Frames
- Apache Software Foundation Apache bRPC
- Authentication bypass
Not analysed yet 21 Oct 2026
CVE-2026-78066 CVE record

CVSS 7.5 High

Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-78058 CVE record

CVSS 7.5 High

Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
- Apache Software Foundation Apache bRPC
- Denial of service
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-78048 CVE record

CVSS 7.5 High

Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-74758 CVE record

CVSS 7.5 High

Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
- Apache Software Foundation Apache bRPC
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-74757 CVE record

CVSS 7.5 High

Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-74755 CVE record

CVSS 7.5 High

Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
- Apache Software Foundation Apache bRPC
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-66392 CVE record

CVSS 5.9 Medium

Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
- Apache Software Foundation Apache bRPC
- Weak cryptography or TLS
Not analysed yet 21 Oct 2026
CVE-2026-61916 CVE record

CVSS 7.5 High

Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
- Apache Software Foundation Apache bRPC
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-61902 CVE record

CVSS 7.5 High

Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-58064 CVE record

CVSS 7.5 High

Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-56388 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache bRPC: Out-of-Bounds Write in Redis Command Parser
- Apache Software Foundation Apache bRPC
- Denial of service
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-56387 CVE record

CVSS 7.5 High

Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-56386 CVE record

CVSS 7.5 High

Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
- Apache Software Foundation Apache bRPC
- Memory corruption
Not analysed yet 21 Oct 2026
CVE-2026-54427 CVE record

CVSS 7.5 High

Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-54426 CVE record

CVSS 7.5 High

Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-54425 CVE record

CVSS 7.5 High

Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 21 Oct 2026
CVE-2026-48830 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
- Apache Software Foundation Apache bRPC
- Authentication bypass
Not analysed yet 21 Oct 2026
CVE-2025-60021 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Apache bRPC: Remote command injection vulnerability in heap builtin service
- Apache Software Foundation Apache bRPC
- Command injection
Not analysed yet 16 Jan 2026
CVE-2025-59789 CVE record

CVSS 7.5 High

Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser
- Apache Software Foundation Apache bRPC
- Denial of service
Not analysed yet 1 Dec 2025
CVE-2025-54472 CVE record

CVSS 7.5 High

Apache bRPC: Redis Parser Remote Denial of Service
- Apache Software Foundation Apache bRPC
- Memory corruption
- Denial of service
Not analysed yet 14 Aug 2025
CVE-2024-23452 CVE record

CVSS 7.5 High

Apache bRPC: HTTP request smuggling vulnerability
- Apache Software Foundation Apache bRPC
- HTTP request smuggling
Not analysed yet 8 Feb 2024
CVE-2023-45757 CVE record

Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability
- Apache Software Foundation Apache bRPC
- Cross-site scripting (XSS)
Not analysed yet 16 Oct 2023
CVE-2023-31039 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution
- Apache Software Foundation Apache bRPC
- CWE-20
Not analysed yet 8 May 2023