Skip to content
Apache Software Foundation Brpc vulnerabilities
-
apache software foundation brpc
Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
CVE-2026-90484
6.5 Medium
-
apache software foundation brpc
Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
CVE-2026-87849
4.3 Medium
-
apache software foundation brpc
Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
CVE-2026-86249
9.1 Critical
-
apache software foundation brpc
Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
CVE-2026-86147
7.5 High
-
apache software foundation brpc
Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
CVE-2026-86146
7.5 High
-
apache software foundation brpc
Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
CVE-2026-84748
7.5 High
-
apache software foundation brpc
Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments
CVE-2026-84747
7.5 High
-
apache software foundation brpc
Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message
CVE-2026-84727
5.4 Medium
-
apache software foundation brpc
Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
CVE-2026-82953
5.3 Medium
-
apache software foundation brpc
Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
CVE-2026-82942
7.5 High
-
apache software foundation brpc
Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service
CVE-2026-82425
7.5 High
-
apache software foundation brpc
Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
CVE-2026-82231
7.5 High
-
apache software foundation brpc
Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
CVE-2026-82230
7.5 High
-
apache software foundation brpc
Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
CVE-2026-82210
7.5 High
-
apache software foundation brpc
Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
CVE-2026-81755
7.5 High
-
apache software foundation brpc
Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
CVE-2026-80463
7.5 High
-
apache software foundation brpc
Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
CVE-2026-79704
7.5 High
-
apache software foundation brpc
Apache bRPC: Missing Authentication for Streaming RPC Frames
CVE-2026-78334
9.1 Critical
-
apache software foundation brpc
Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
CVE-2026-78066
7.5 High
-
apache software foundation brpc
Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
CVE-2026-78058
7.5 High
-
apache software foundation brpc
Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
CVE-2026-78048
7.5 High
-
apache software foundation brpc
Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
CVE-2026-74758
7.5 High
-
apache software foundation brpc
Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
CVE-2026-74757
7.5 High
-
apache software foundation brpc
Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
CVE-2026-74755
7.5 High
-
apache software foundation brpc
Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
CVE-2026-66392
5.9 Medium
-
apache software foundation brpc
Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
CVE-2026-61916
7.5 High
-
apache software foundation brpc
Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
CVE-2026-61902
7.5 High
-
apache software foundation brpc
Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
CVE-2026-58064
7.5 High
-
apache software foundation brpc
Apache bRPC: Out-of-Bounds Write in Redis Command Parser
CVE-2026-56388
9.1 Critical
-
apache software foundation brpc
Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
CVE-2026-56387
7.5 High
-
apache software foundation brpc
Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
CVE-2026-56386
7.5 High
-
apache software foundation brpc
Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
CVE-2026-54427
7.5 High
-
apache software foundation brpc
Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
CVE-2026-54426
7.5 High
-
apache software foundation brpc
Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
CVE-2026-54425
7.5 High
-
apache software foundation brpc
Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
CVE-2026-48830
9.1 Critical
-
apache brpc
Apache bRPC: Remote command injection vulnerability in heap builtin service
CVE-2025-60021
Public exploit
EPSS 25.7%
9.8 Critical
-
apache brpc
Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser
CVE-2025-59789
7.5 High
-
apache brpc
Apache bRPC: Redis Parser Remote Denial of Service
CVE-2025-54472
7.5 High
-
apache brpc
Apache bRPC: HTTP request smuggling vulnerability
CVE-2024-23452
7.5 High
-
apache brpc
Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability
CVE-2023-45757
6.1 Medium
-
apache brpc
Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution
CVE-2023-31039
9.8 Critical