CVE-2026-86146

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. Verification runs only for the first message of a connection and the result latches the connection, so a request such as GET /status to internal_port authenticates the whole connection.

Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) allows a remote attacker to bypass server authentication and inject or deliver streaming frames when a server is configured with an Authenticator. Streaming frames never pass through the authentication hook, and streams can be impersonated by another socket carrying the same id.

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process.

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP services are publicly exposed, the first builtin request may mark the connection as authenticated for later requests.

Remote command injection vulnerability in heap profiler builtin service in Apache bRPC (all versions < 1.15.0) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter. Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.

Apache bRPC < 1.5.0 on all platforms allows attackers to execute arbitrary code via the ServerOptions::pid_file parameter. An attacker who can influence this parameter when starting the bRPC server can execute arbitrary code with the permissions of the bRPC process.

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A packet with declared zero payload length passes the frame-length check, after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, causing type = p[4] to dereference it and crash the client process.

A vulnerability in the Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that they are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries triggers an out-of-bounds read and potentially crashes the bRPC client.

Apache bRPC versions before 1.18.0 expose builtin /flags and /pprof services that allow a remote attacker to change dump paths (bvar_dump_file, bvar_dump_tabs, mbvar_dump_file) and create directories or overwrite files with the server process privileges. Additionally, the ?seconds= parameter in /pprof is not clamped, enabling an attacker to hold the process-wide CPU profiler for an arbitrarily long time.

Improper authorization in Apache bRPC (versions < 1.18.0) allows remote attackers to access builtin services through the public port. Protobuf-based protocol dispatch paths computed but did not enforce the security_mode flag, allowing invocation of services such as brpc.vars or hotspots.