What’s Vulnerable › Products

Apache Software Foundation Apache bRPC vulnerabilities

41 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 38 published in the last 12 months.

Check whether your Apache Software Foundation Apache bRPC version is affected

Latest Apache Software Foundation Apache bRPC vulnerabilities

• CVE-2026-90484 — Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash (CVSS 6.5)
• CVE-2026-87849 — Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing (CVSS 4.3)
• CVE-2026-86249 — Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
• CVE-2026-81755 — Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
• CVE-2026-80463 — Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
• CVE-2026-79704 — Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
• CVE-2026-78334 — Apache bRPC: Missing Authentication for Streaming RPC Frames
• CVE-2026-78066 — Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
• CVE-2026-78058 — Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
• CVE-2026-78048 — Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
• CVE-2026-74758 — Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
• CVE-2026-74755 — Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
• CVE-2026-66392 — Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
• CVE-2026-61916 — Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
• CVE-2026-61902 — Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
• CVE-2026-58064 — Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
• CVE-2026-56388 — Apache bRPC: Out-of-Bounds Write in Redis Command Parser
• CVE-2026-56387 — Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
• CVE-2026-56386 — Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser (CVSS 7.5)
• CVE-2026-54427 — Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
• CVE-2026-54426 — Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
• CVE-2026-54425 — Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
• CVE-2026-48830 — Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
• CVE-2026-86147 — Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
• CVE-2026-86146 — Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing