Apache Brpc
Monthly
Remote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is enabled, where a single crafted RTMP Abort control message that names the chunk stream currently being parsed triggers a heap use-after-free and crashes the server. Exploitation requires the non-default ServerOptions.rtmp_service configuration and network reachability to the RTMP listener; with that precondition, no credentials, user interaction, or application-level request are needed. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis.
Memory exhaustion in Apache bRPC versions prior to 1.18.0 lets remote attackers force excessive preallocation on servers that terminate Baidu ubrpc traffic through a NsheadService wired to UbrpcMcpack2Adaptor and parse it with code generated by the mcpack2pb protoc plugin. Because the mcpack request body is parsed before authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), a single unauthenticated request declaring an array item count such as 0x7fffffff can drive roughly 16GB of virtual memory reservation and may abort the process (SIGABRT) on memory-constrained hosts, making this an availability-only denial of service (CWE-770). There is no CVSS score or EPSS probability in the source data, the CVE is not in CISA KEV, and no public exploit code is referenced, so exploitation status is no public exploit identified at time of analysis; the vulnerable adaptor wiring is non-default, so stock bRPC servers that do not use it are unaffected.
Memory and CPU exhaustion in Apache bRPC's Redis-protocol handler lets remote unauthenticated clients inflate server resource usage by sending long inline commands that never terminate with CRLF. The parser sizes its allocation from the current connection buffer and copies the whole buffer before it has located the inline command boundary, because the redis_max_allocation_size guard was enforced only for RESP bulk strings and arrays, not for the inline path. Every bRPC release before 1.18.0 is affected when the optional Redis protocol is enabled and reachable by untrusted clients; impact is limited to denial of service (availability only), with no code execution or data disclosure reported. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a low-complexity, unauthenticated network trigger.
Out-of-bounds write in Apache bRPC's Redis RESP parser allows remote unauthenticated attackers who can reach a bRPC server with ServerOptions.redis_service enabled to send an empty RESP array header followed by a bulk string, causing a parser memory corruption and process crash. The independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with exploitation limited by the opt-in Redis service and by non-default fatal-log behavior that must fail to abort before the indexed write. No CISA KEV entry or public exploit code was identified at time of analysis, and Apache bRPC 1.18.0 contains the fix.
Memory exhaustion in Apache bRPC's RTMP AMF parser allows unauthenticated remote attackers to consume excessive resources on servers that opt into the RTMP component. Versions before 1.18.0 accept attacker-declared long-string lengths and array element counts without first confirming the payload contains enough bytes, so a small AMF message can force oversized allocations before parsing fails. RTMP is not enabled by default, and no public exploit has been identified at time of analysis.
Denial of service in Apache bRPC servers that accept HTTP/2 traffic is caused by a malformed DATA frame with the PADDED flag set and a zero-length payload. An unauthenticated remote attacker with network reachability to an h2c- or TLS-ALPN-exposed HTTP/2 listener can trigger an integer underflow and out-of-bounds read, leading to high availability impact; versions before 1.18.0 are affected. No public exploit was identified at time of analysis, and the independent assessment rates the issue as network-reachable, low complexity, and requiring no privileges or user interaction.
Denial of service in Apache bRPC before 1.18.0 allows an unauthenticated remote RTMP peer to crash the bRPC process by sending deeply nested AMF objects or arrays, exhausting the native stack. Exploitation is limited to deployments that use bRPC's RTMP support and parse AMF data from untrusted peers, such as RTMP servers handling client command messages or RTMP clients handling server responses, metadata, or cue points. No CISA KEV confirmation or public exploit code was identified at time of analysis.
Remote denial of service in Apache bRPC (versions before 1.18.0) allows a malicious, compromised, or faulty Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply, driving the reply parser into unbounded recursion until the stack is exhausted. Applications that use bRPC as a Redis client with ChannelOptions.protocol="redis" and that accept replies from an untrusted or tampered-with Redis peer are affected, while deployments that only ever connect to trusted, operator-controlled Redis instances are effectively not exposed. No authentication or user interaction on the client is required to trigger the crash once a crafted reply is delivered; no public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis.
Remote unauthenticated denial of service in Apache bRPC before 1.18.0 allows attackers to exhaust the server thread stack by sending a crafted HTTP/2 header block containing many consecutive HPACK Dynamic Table Size Update entries, potentially crashing or hanging the process. The root cause is uncontrolled recursion (CWE-674) in bRPC's built-in HPACK decoder, reachable when the built-in HTTP/2 server accepts traffic from untrusted networks. No public exploit code was identified at time of analysis, and the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is limited to availability.
Apache bRPC through 1.17.0 can treat an HTTP/1.1 keep-alive connection as authenticated after a builtin HTTP request is sent as the first message, allowing remote unauthenticated attackers to bypass authentication for protected non-builtin HTTP endpoints when ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener. The Apache project identifies 1.18.0 as the fixed release and provides a patch PR; no public exploit code was identified at time of analysis.
A single unauthenticated request can abort an Apache bRPC server (versions before 1.18.0) that has been explicitly configured to accept nshead frames through the ubrpc mcpack2 adaptor, because an integer underflow in UnparsedValue::as_string() turns a zero-length string field into a SIZE_MAX resize() call whose uncaught std::length_error terminates the process with SIGABRT. Per the independent assessment this rates CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, but the reachable surface is non-default: stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so only deployments following the NsheadService + UbrpcMcpack2Adaptor pattern are exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability - no code execution or data exposure is described.
TLS endpoint impersonation in Apache bRPC before 1.18.0 allows an on-path attacker who can redirect or intercept a client Channel connection to present a CA-trusted certificate for a different identity and impersonate the intended TLS server, affecting confidentiality and integrity. The flaw is only reachable when client-side TLS peer verification (VERIFY_PEER) is enabled, the connection crosses an untrusted network, and the client trusts a CA capable of issuing certificates for other names; HTTPS Channels that verify the URL host are not affected. No public exploit was identified at time of analysis, and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
Remote denial of service affects Apache bRPC deployments before 1.18.0 when built on platforms where plain char is unsigned, notably ARM64. Unauthenticated attackers can send a crafted request URI containing a high-bit byte (0x80-0xFF) to an HTTP server, triggering out-of-bounds reads in URL parsing; the case-insensitive header-name lookup is also reachable through APIs that process untrusted header names, such as the HTTP/2 HPACK path, and the result can be a process crash. x86_64 builds with signed plain char are not affected, and no public exploit identified at time of analysis.
Memory exhaustion denial of service in Apache bRPC before 1.18.0 allows remote unauthenticated peers to push buffered message data past the configured max_body_size limit when the service uses non-progressive HTTP/1, non-progressive HTTP/2, memcache, or couchbase parsing paths. The assessed vector is network-reachable, low-complexity, unauthenticated denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability. No public exploit was identified at time of analysis, and progressive HTTP reading is not affected because it uses bounded buffering.
Remote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is enabled, where a single crafted RTMP Abort control message that names the chunk stream currently being parsed triggers a heap use-after-free and crashes the server. Exploitation requires the non-default ServerOptions.rtmp_service configuration and network reachability to the RTMP listener; with that precondition, no credentials, user interaction, or application-level request are needed. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis.
Memory exhaustion in Apache bRPC versions prior to 1.18.0 lets remote attackers force excessive preallocation on servers that terminate Baidu ubrpc traffic through a NsheadService wired to UbrpcMcpack2Adaptor and parse it with code generated by the mcpack2pb protoc plugin. Because the mcpack request body is parsed before authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), a single unauthenticated request declaring an array item count such as 0x7fffffff can drive roughly 16GB of virtual memory reservation and may abort the process (SIGABRT) on memory-constrained hosts, making this an availability-only denial of service (CWE-770). There is no CVSS score or EPSS probability in the source data, the CVE is not in CISA KEV, and no public exploit code is referenced, so exploitation status is no public exploit identified at time of analysis; the vulnerable adaptor wiring is non-default, so stock bRPC servers that do not use it are unaffected.
Memory and CPU exhaustion in Apache bRPC's Redis-protocol handler lets remote unauthenticated clients inflate server resource usage by sending long inline commands that never terminate with CRLF. The parser sizes its allocation from the current connection buffer and copies the whole buffer before it has located the inline command boundary, because the redis_max_allocation_size guard was enforced only for RESP bulk strings and arrays, not for the inline path. Every bRPC release before 1.18.0 is affected when the optional Redis protocol is enabled and reachable by untrusted clients; impact is limited to denial of service (availability only), with no code execution or data disclosure reported. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a low-complexity, unauthenticated network trigger.
Out-of-bounds write in Apache bRPC's Redis RESP parser allows remote unauthenticated attackers who can reach a bRPC server with ServerOptions.redis_service enabled to send an empty RESP array header followed by a bulk string, causing a parser memory corruption and process crash. The independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with exploitation limited by the opt-in Redis service and by non-default fatal-log behavior that must fail to abort before the indexed write. No CISA KEV entry or public exploit code was identified at time of analysis, and Apache bRPC 1.18.0 contains the fix.
Memory exhaustion in Apache bRPC's RTMP AMF parser allows unauthenticated remote attackers to consume excessive resources on servers that opt into the RTMP component. Versions before 1.18.0 accept attacker-declared long-string lengths and array element counts without first confirming the payload contains enough bytes, so a small AMF message can force oversized allocations before parsing fails. RTMP is not enabled by default, and no public exploit has been identified at time of analysis.
Denial of service in Apache bRPC servers that accept HTTP/2 traffic is caused by a malformed DATA frame with the PADDED flag set and a zero-length payload. An unauthenticated remote attacker with network reachability to an h2c- or TLS-ALPN-exposed HTTP/2 listener can trigger an integer underflow and out-of-bounds read, leading to high availability impact; versions before 1.18.0 are affected. No public exploit was identified at time of analysis, and the independent assessment rates the issue as network-reachable, low complexity, and requiring no privileges or user interaction.
Denial of service in Apache bRPC before 1.18.0 allows an unauthenticated remote RTMP peer to crash the bRPC process by sending deeply nested AMF objects or arrays, exhausting the native stack. Exploitation is limited to deployments that use bRPC's RTMP support and parse AMF data from untrusted peers, such as RTMP servers handling client command messages or RTMP clients handling server responses, metadata, or cue points. No CISA KEV confirmation or public exploit code was identified at time of analysis.
Remote denial of service in Apache bRPC (versions before 1.18.0) allows a malicious, compromised, or faulty Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply, driving the reply parser into unbounded recursion until the stack is exhausted. Applications that use bRPC as a Redis client with ChannelOptions.protocol="redis" and that accept replies from an untrusted or tampered-with Redis peer are affected, while deployments that only ever connect to trusted, operator-controlled Redis instances are effectively not exposed. No authentication or user interaction on the client is required to trigger the crash once a crafted reply is delivered; no public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis.
Remote unauthenticated denial of service in Apache bRPC before 1.18.0 allows attackers to exhaust the server thread stack by sending a crafted HTTP/2 header block containing many consecutive HPACK Dynamic Table Size Update entries, potentially crashing or hanging the process. The root cause is uncontrolled recursion (CWE-674) in bRPC's built-in HPACK decoder, reachable when the built-in HTTP/2 server accepts traffic from untrusted networks. No public exploit code was identified at time of analysis, and the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is limited to availability.
Apache bRPC through 1.17.0 can treat an HTTP/1.1 keep-alive connection as authenticated after a builtin HTTP request is sent as the first message, allowing remote unauthenticated attackers to bypass authentication for protected non-builtin HTTP endpoints when ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener. The Apache project identifies 1.18.0 as the fixed release and provides a patch PR; no public exploit code was identified at time of analysis.
A single unauthenticated request can abort an Apache bRPC server (versions before 1.18.0) that has been explicitly configured to accept nshead frames through the ubrpc mcpack2 adaptor, because an integer underflow in UnparsedValue::as_string() turns a zero-length string field into a SIZE_MAX resize() call whose uncaught std::length_error terminates the process with SIGABRT. Per the independent assessment this rates CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, but the reachable surface is non-default: stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so only deployments following the NsheadService + UbrpcMcpack2Adaptor pattern are exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability - no code execution or data exposure is described.
TLS endpoint impersonation in Apache bRPC before 1.18.0 allows an on-path attacker who can redirect or intercept a client Channel connection to present a CA-trusted certificate for a different identity and impersonate the intended TLS server, affecting confidentiality and integrity. The flaw is only reachable when client-side TLS peer verification (VERIFY_PEER) is enabled, the connection crosses an untrusted network, and the client trusts a CA capable of issuing certificates for other names; HTTPS Channels that verify the URL host are not affected. No public exploit was identified at time of analysis, and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
Remote denial of service affects Apache bRPC deployments before 1.18.0 when built on platforms where plain char is unsigned, notably ARM64. Unauthenticated attackers can send a crafted request URI containing a high-bit byte (0x80-0xFF) to an HTTP server, triggering out-of-bounds reads in URL parsing; the case-insensitive header-name lookup is also reachable through APIs that process untrusted header names, such as the HTTP/2 HPACK path, and the result can be a process crash. x86_64 builds with signed plain char are not affected, and no public exploit identified at time of analysis.
Memory exhaustion denial of service in Apache bRPC before 1.18.0 allows remote unauthenticated peers to push buffered message data past the configured max_body_size limit when the service uses non-progressive HTTP/1, non-progressive HTTP/2, memcache, or couchbase parsing paths. The assessed vector is network-reachable, low-complexity, unauthenticated denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability. No public exploit was identified at time of analysis, and progressive HTTP reading is not affected because it uses bounded buffering.