Apache Software Foundation Apache bRPC

• CVE-2026-90484 Medium 6.5 Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash 0.4%
• CVE-2026-87849 Medium 4.3 Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing 0.4%
• CVE-2026-86249 Critical 9.1 Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth 0.6%
• CVE-2026-86147 High 7.5 Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof 0.5%
• CVE-2026-86146 High 7.5 Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing 0.5%
• CVE-2026-84748 High 7.5 Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration 0.4%
• CVE-2026-84747 High 7.5 Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments 0.5%
• CVE-2026-84727 Medium 5.4 Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message 0.3%
• CVE-2026-82953 Medium 5.3 Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service 0.5%
• CVE-2026-82942 High 7.5 Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service 0.4%
• CVE-2026-82425 High 7.5 Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service 0.4%
• CVE-2026-82231 High 7.5 Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client 0.4%
• CVE-2026-82230 High 7.5 Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser 0.5%
• CVE-2026-82210 High 7.5 Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames 0.5%
• CVE-2026-81755 High 7.5 Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request 0.7%
• CVE-2026-80463 High 7.5 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly 0.6%
• CVE-2026-79704 High 7.5 Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling 0.5%
• CVE-2026-78334 Critical 9.1 Apache bRPC: Missing Authentication for Streaming RPC Frames 0.7%
• CVE-2026-78066 High 7.5 Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes 0.5%
• CVE-2026-78058 High 7.5 Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path 0.8%
• CVE-2026-78048 High 7.5 Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder 0.6%
• CVE-2026-74758 High 7.5 Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling 0.6%
• CVE-2026-74757 High 7.5 Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count 0.6%
• CVE-2026-74755 High 7.5 Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service 0.6%
• CVE-2026-66392 Medium 5.9 Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names 0.2%
• CVE-2026-61916 High 7.5 Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms 0.6%
• CVE-2026-61902 High 7.5 Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits 0.5%
• CVE-2026-58064 High 7.5 Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation 0.6%
• CVE-2026-56388 Critical 9.1 Apache bRPC: Out-of-Bounds Write in Redis Command Parser 1.0%
• CVE-2026-56387 High 7.5 Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser 0.6%
• CVE-2026-56386 High 7.5 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser 0.7%
• CVE-2026-54427 High 7.5 Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser 0.5%
• CVE-2026-54426 High 7.5 Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser 0.5%
• CVE-2026-54425 High 7.5 Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding 0.7%
• CVE-2026-48830 Critical 9.1 Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests 0.6%
• CVE-2025-60021 Critical 9.8 Apache bRPC: Remote command injection vulnerability in heap builtin service 25.7%
• CVE-2025-59789 High 7.5 Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser 1.7%
• CVE-2025-54472 High 7.5 Apache bRPC: Redis Parser Remote Denial of Service 1.3%
• CVE-2024-23452 High 7.5 Apache bRPC: HTTP request smuggling vulnerability 1.6%
• CVE-2023-45757 Unrated Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability 1.2%
• CVE-2023-31039 Critical 9.8 Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution 1.5%