Do Son 
TL;DR
The Apache Software Foundation released Apache bRPC 1.18.0 to patch 35 newly disclosed Apache bRPC vulnerabilities. This update resolves 16 high-severity and 19 moderate-severity flaws that enable authentication bypass, memory corruption, and remote denial of service. Consequently, developers and administrators must upgrade their RPC frameworks immediately to secure exposed services.
Why It Matters
Apache bRPC is an industrial-grade RPC framework used to build high-performance distributed systems and microservices. While exact global deployment numbers are not specified in the vendor advisory, major technology companies rely on bRPC to handle massive internal and external network traffic.
These 35 Apache bRPC vulnerabilities expose unpatched servers and clients to process crashes, memory exhaustion, and unauthorized endpoint access. Multiple researchers, including Nikko Enggaliano Pratama, Feng Zhijie, Ubeddulla Khan, 73Lab, and Claude, reported the bugs. Currently, no public proof-of-concept exploit code has been confirmed, and no active exploitation in the wild has been reported.
How the Attack Works
The flaws span multiple protocol parsers, including HTTP/1.1, HTTP/2, Redis, RTMP, mcpack2pb, Thrift, and MySQL.
Authentication Bypass and Access Control Flaws
First, CVE-2026-48830 allows unauthenticated attackers to bypass authentication on protected HTTP endpoints. When a client sends a builtin HTTP request first over an HTTP/1.1 keep-alive connection, the socket remains marked as authenticated for subsequent requests. Similarly, CVE-2026-86249 latches authentication states on internal ports, while CVE-2026-78334 bypasses authentication hooks for streaming RPC frames. In addition, CVE-2026-84747 and CVE-2026-86146 enable proxy ACL bypasses and HTTP request smuggling, whereas CVE-2026-86147 lets attackers truncate arbitrary files via the /flags builtin service.
Memory Corruption and Resource Exhaustion
Furthermore, several high-severity bugs trigger memory corruption or crashes. For example, CVE-2026-56388 causes an out-of-bounds write in the Redis command parser when processing an empty RESP array header. Meanwhile, CVE-2026-74758 and CVE-2026-84727 trigger heap use-after-free conditions in RTMP Abort message handling. Additionally, unbounded recursion flaws in the HTTP/2 HPACK decoder (CVE-2026-54425), Redis reply parser (CVE-2026-54426), AMF parser (CVE-2026-54427), and mcpack2pb parser (CVE-2026-82230) allow remote peers to exhaust the thread stack. Finally, flaws like CVE-2026-78058 and CVE-2026-78066 enable unbounded memory allocation via crafted HTTP/2 frames and compressed payloads.
Affected Versions
Almost all of the disclosed Apache bRPC vulnerabilities affect versions through 1.17.0, while CVE-2026-79704 specifically impacts versions 1.11.0 through 1.17.0. Version 1.18.0 is unaffected.
Patch and Mitigation Steps
The Apache bRPC team resolved all 35 issues in version 1.18.0 by enforcing strict recursion depths, bounding memory allocations, and validating authentication per request. Administrators should obtain the latest release from the official Apache bRPC download page immediately. Alternatively, teams that cannot upgrade right away can apply the individual GitHub pull request patches referenced in the advisory and restrict public access to builtin services.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
