Apache bRPC CVE-2026-61916

Exploitation requires the target to be an Apache bRPC HTTP server (before 1.18.0) compiled on a platform where plain char is unsigned - explicitly ARM64; x86_64 builds are NOT affected and this is the primary limiting factor. The attacker sends an unauthenticated request URI containing a byte with the high bit set (0x80-0xFF), reaching the vulnerable URL-parsing lookup. The case-insensitive header-name lookup is reachable only via APIs that process untrusted header names such as the HTTP/2 HPACK path; HTTP/1 header names with high-bit bytes are rejected by the HTTP/1 parser before reaching the sink, so HTTP/1 header-based exploitation is not possible. No authentication or user interaction is required on affected platforms.

No CVSS vector, EPSS score, KEV listing, or POC is provided in the input, so quantitative exploitation signals are entirely absent and this assessment rests on the vendor description alone. Based on my independent analysis the real-world impact ceiling is a denial of service only - the out-of-bounds read (CWE-125) corrupts a table-lookup index and crashes the process rather than returning memory to the attacker, so despite the 'Information Disclosure' tag the described consequence is a process crash, not data leakage. The flaw is remotely reachable and unauthenticated (an unauthenticated request URI or HPACK-decoded header name), which raises network exposure, but it is strictly conditional on a platform where plain char is unsigned (notably ARM64); x86_64 builds, which dominate server fleets, are explicitly not affected. This platform dependency is the single most important risk modifier and means a given deployment is either exploitable by default or not exploitable at all. Net assessment: a genuine availability issue worth patching on ARM64 bRPC HTTP servers, but not a widespread critical-code-execution event - treat as medium priority, elevated only for ARM-based or heterogeneous deployments. No evidence of active exploitation exists in the provided data.

An attacker identifies a remotely accessible Apache bRPC HTTP server running on an ARM64 (unsigned-char) build and sends an unauthenticated HTTP request whose URI contains a byte with the high bit set (0x80-0xFF), or supplies a crafted header name via the HTTP/2 HPACK path. The biased lookup table is indexed out of bounds, reading up to 127 bytes past its end and crashing the worker process, producing a denial of service. No public exploit was identified at time of analysis, though the root cause is precisely documented in the vendor advisory and patch PR.