Is CVE-2026-86146 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86146 being exploited in the wild.

How severe is CVE-2026-86146?

Informational severity, published 21 October 2026.

How is CVE-2026-86146 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86146?

Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86146: Apache bRPC HTTP request/response smuggling in bundled parser

Q: Is there a fix for CVE-2026-86146?

Yes: fixed in 1.18.0. Until then: Apply the patch from https://github.com/apache/brpc/pull/3521 if immediate upgrade is not possible. After patching, the non-conformant header forms are rejected by default; use gflags http_allow_obs_fold=true or http_strict_header_token=true only if legacy clients require the obsolete forms. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-86146 · Severity: info · Published 2026-10-21

Apache bRPC is a high-performance RPC framework used to build distributed services. When deployed behind a proxy or load balancer, its HTTP/1.1 parser interprets malformed headers differently than standard parsers, allowing attackers to inject false headers (like authorization credentials), forge forwarding information, or desynchronize request/response framing between the proxy and bRPC. This can lead to request smuggling, header injection, and bypassing proxy-level security controls.

Technologies: Apache Brpc. Vendors: Apache.

Quick answers

Is CVE-2026-86146 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86146 being exploited in the wild.
How severe is CVE-2026-86146?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Brpc < 1.18.0.
Is there a fix for CVE-2026-86146?: Yes: fixed in 1.18.0. Until then: Apply the patch from https://github.com/apache/brpc/pull/3521 if immediate upgrade is not possible. After patching, the non-conformant header forms are rejected by default; use gflags http_allow_obs_fold=true or http_strict_header_token=true only if legacy clients require the obsolete forms. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86146 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86146?: Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.18.0

Apply the patch from https://github.com/apache/brpc/pull/3521 if immediate upgrade is not possible. After patching, the non-conformant header forms are rejected by default; use gflags http_allow_obs_fold=true or http_strict_header_token=true only if legacy clients require the obsolete forms.

Technical details

The bRPC HTTP/1.1 parser accepts five classes of non-conformant HTTP/1.1 syntax: spaces before header colons, interior spaces in Content-Length values, obsolete line folding in framing headers, chunked trailer fields merged into the header map, and Transfer-Encoding lists with optional whitespace after commas. These inconsistencies allow an attacker to craft requests that parse differently at a front-end proxy versus bRPC, enabling request smuggling, header injection (Authorization, X-Forwarded-For), and response desynchronization. The vulnerability affects any bRPC deployment communicating over HTTP/1.1 with independent parsers such as proxies or load balancers.

Affected products

Apache bRPC < 1.18.0

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.