CVE-2026-61916
Received Received - Intake

Out-of-bounds Read in Apache bRPC URL Parsing

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: Apache Software Foundation

Description
Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit set. Root Cause: Two 256-entry lookup tables are accessed through pointers biased by 128 so that valid indices are in the range -128 to 127. Input bytes are promoted from plain char to int without first normalizing them to the signed-char range. On affected platforms, bytes in the range 0x80 to 0xFF therefore become indices 128 to 255 and read up to 127 bytes beyond the end of the underlying tables. Affected Scenarios: A remotely accessible bRPC HTTP server on an affected platform can reach the vulnerable URL lookup through an unauthenticated request URI containing a high-bit byte. The case-insensitive lookup is also reachable when untrusted header names are processed through APIs such as the HTTP/2 HPACK path. HTTP/1 header names containing high-bit bytes are rejected by the HTTP/1 parser before reaching the vulnerable lookup. Builds where plain char is signed, which commonly include x86_64 builds, are not affected by this issue. How to Fix: Choose one of the following options: 1. Upgrade Apache bRPC to version 1.18.0 or later. 2. Apply the patch from https://github.com/apache/brpc/pull/3376 . The fix normalizes lookup-table indices to the signed-char range before accessing the biased tables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-10-21
AI Q&A
2026-10-21
EPSS Evaluated
N/A
NVD
CVE-2026-61916
EUVD
EUVD-2026-107177

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache bRPC 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in Apache bRPC before version 1.18.0. It occurs on platforms where plain char is unsigned, like ARM64. The issue involves two 256-entry lookup tables accessed through pointers biased by 128. Input bytes with high bits set (0x80 to 0xFF) become invalid indices (128 to 255), causing reads beyond the table boundaries and leading to process crashes or denial of service.

Detection Guidance

Detecting this vulnerability requires checking if your Apache bRPC version is below 1.18.0 on an affected platform like ARM64. Run 'curl -s http://<server>/ | grep "bRPC"' to check the version. If the server crashes when sending a URI with high-bit bytes (e.g., %80), it may be vulnerable.

Impact Analysis

If you run an Apache bRPC HTTP server on an affected platform (e.g., ARM64), a remote attacker could send a crafted request with high-bit bytes in the URI or headers. This could crash the server, causing a denial of service. Systems using x86_64 are not affected as plain char is signed there.

Mitigation Strategies

Upgrade Apache bRPC to version 1.18.0 or later. Alternatively, apply the patch from https://github.com/apache/brpc/pull/3376. If upgrading is not possible, restrict network access to the bRPC HTTP server until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61916. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart