{"schema_version":1,"title":"Apache Brpc vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 36 vulnerabilities in Apache Brpc: 0 in the last 7 days and 35 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90484, was published on 21 October 2026. 35 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/brpc","json_url":"https://junglewise.ai/threats/technologies/brpc.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/brpc","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":1,"all_time":36,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":35,"last_90_days":35,"last_365_days":36},"latest":[{"cve":"CVE-2026-90484","slug":"cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a","title":"Apache bRPC MySQL client null pointer dereference","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:56.59+00:00","url":"https://junglewise.ai/threats/cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a"},{"cve":"CVE-2026-87849","slug":"cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions","title":"Apache bRPC Discovery naming-service JSON parsing crash","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:04.603+00:00","url":"https://junglewise.ai/threats/cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions"},{"cve":"CVE-2026-86249","slug":"cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and","title":"brpc Server authentication bypass via internal_port","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:04.47+00:00","url":"https://junglewise.ai/threats/cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and"},{"cve":"CVE-2026-86147","slug":"cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource","title":"Apache bRPC path traversal and resource exhaustion in builtin services","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:04.317+00:00","url":"https://junglewise.ai/threats/cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource"},{"cve":"CVE-2026-86146","slug":"cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request","title":"Apache bRPC HTTP request/response smuggling in bundled parser","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:04.137+00:00","url":"https://junglewise.ai/threats/cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request"},{"cve":"CVE-2026-84748","slug":"cve-2026-84748-improper-authorization-in-apache-brpc-versions-1-18-0-on-all","title":"Apache bRPC improper authorization in protobuf protocol dispatch","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.997+00:00","url":"https://junglewise.ai/threats/cve-2026-84748-improper-authorization-in-apache-brpc-versions-1-18-0-on-all"},{"cve":"CVE-2026-84747","slug":"cve-2026-84747-interpretation-conflict-in-the-http-protocol-implementation-in","title":"Apache bRPC HTTP protocol interpretation conflict access control bypass","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.847+00:00","url":"https://junglewise.ai/threats/cve-2026-84747-interpretation-conflict-in-the-http-protocol-implementation-in"},{"cve":"CVE-2026-84727","slug":"cve-2026-84727-use-after-free-in-the-rtmp-protocol-implementation-in-apache-brpc","title":"Apache bRPC use-after-free in RTMP protocol implementation","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.697+00:00","url":"https://junglewise.ai/threats/cve-2026-84727-use-after-free-in-the-rtmp-protocol-implementation-in-apache-brpc"},{"cve":"CVE-2026-82953","slug":"cve-2026-82953-null-pointer-dereference-in-the-rtmp-protocol-implementation-in","title":"Apache bRPC NULL pointer dereference in RTMP createStream","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.56+00:00","url":"https://junglewise.ai/threats/cve-2026-82953-null-pointer-dereference-in-the-rtmp-protocol-implementation-in"},{"cve":"CVE-2026-82942","slug":"cve-2026-82942-a-data-race-in-the-rdma-transport-of-apache-brpc-versions-1-18-0","title":"Apache bRPC data race in RDMA transport","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.403+00:00","url":"https://junglewise.ai/threats/cve-2026-82942-a-data-race-in-the-rdma-transport-of-apache-brpc-versions-1-18-0"},{"cve":"CVE-2026-82425","slug":"cve-2026-82425-a-reachable-assertion-in-apache-brpc-version-1-18-0-on-all","title":"Apache bRPC denial of service via assertion in health check","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.247+00:00","url":"https://junglewise.ai/threats/cve-2026-82425-a-reachable-assertion-in-apache-brpc-version-1-18-0-on-all"},{"cve":"CVE-2026-82231","slug":"cve-2026-82231-a-thrift-client-in-apache-brpc-version-1-18-0-built-with-with","title":"Apache bRPC Thrift client denial of service","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.1+00:00","url":"https://junglewise.ai/threats/cve-2026-82231-a-thrift-client-in-apache-brpc-version-1-18-0-built-with-with"},{"cve":"CVE-2026-82230","slug":"cve-2026-82230-uncontrolled-recursion-in-the-mcpack2pb-component-in-apache-brpc","title":"Apache bRPC uncontrolled recursion in mcpack2pb parser","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:02.97+00:00","url":"https://junglewise.ai/threats/cve-2026-82230-uncontrolled-recursion-in-the-mcpack2pb-component-in-apache-brpc"},{"cve":"CVE-2026-82210","slug":"cve-2026-82210-enforceable-assertion-in-the-streaming-feature-of-apache-brpc","title":"Apache bRPC assertion failure in streaming feature","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:02.837+00:00","url":"https://junglewise.ai/threats/cve-2026-82210-enforceable-assertion-in-the-streaming-feature-of-apache-brpc"},{"cve":"CVE-2026-81755","slug":"cve-2026-81755-uncontrolled-resource-consumption-in-the-streaming-rpc-component","title":"Apache bRPC uncontrolled resource consumption in streaming RPC","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:24.283+00:00","url":"https://junglewise.ai/threats/cve-2026-81755-uncontrolled-resource-consumption-in-the-streaming-rpc-component"},{"cve":"CVE-2026-80463","slug":"cve-2026-80463-unbounded-memory-accumulation-in-the-stream-message-reassembly","title":"Apache bRPC unbounded memory accumulation in stream reassembly","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:24.093+00:00","url":"https://junglewise.ai/threats/cve-2026-80463-unbounded-memory-accumulation-in-the-stream-message-reassembly"},{"cve":"CVE-2026-79704","slug":"cve-2026-79704-an-out-of-bounds-read-vulnerability-exists-in-the-streaming-rpc","title":"Apache bRPC out-of-bounds read in streaming RPC client","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:23.787+00:00","url":"https://junglewise.ai/threats/cve-2026-79704-an-out-of-bounds-read-vulnerability-exists-in-the-streaming-rpc"},{"cve":"CVE-2026-78334","slug":"cve-2026-78334-missing-authentication-in-the-streaming-rpc-path-of-apache-brpc","title":"Apache bRPC missing authentication in streaming RPC","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:23.65+00:00","url":"https://junglewise.ai/threats/cve-2026-78334-missing-authentication-in-the-streaming-rpc-path-of-apache-brpc"},{"cve":"CVE-2026-78066","slug":"cve-2026-78066-resource-exhaustion-in-apache-brpc-version-1-18-0-on-all","title":"Apache bRPC resource exhaustion in compression and wire parsers","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:23.527+00:00","url":"https://junglewise.ai/threats/cve-2026-78066-resource-exhaustion-in-apache-brpc-version-1-18-0-on-all"},{"cve":"CVE-2026-78058","slug":"cve-2026-78058-uncontrolled-resource-consumption-in-the-http-2-h2-receive-path","title":"Apache bRPC HTTP/2 receive path resource consumption","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:23.373+00:00","url":"https://junglewise.ai/threats/cve-2026-78058-uncontrolled-resource-consumption-in-the-http-2-h2-receive-path"},{"cve":"CVE-2026-78048","slug":"cve-2026-78048-a-reachable-assertion-flaw-in-the-hpack-header-compression","title":"Apache bRPC assertion failure in HPACK decoder","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:23.213+00:00","url":"https://junglewise.ai/threats/cve-2026-78048-a-reachable-assertion-flaw-in-the-hpack-header-compression"},{"cve":"CVE-2026-74758","slug":"cve-2026-74758-a-heap-use-after-free-in-the-rtmp-protocol-component-of-apache","title":"Apache bRPC heap use-after-free in RTMP protocol","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:22.863+00:00","url":"https://junglewise.ai/threats/cve-2026-74758-a-heap-use-after-free-in-the-rtmp-protocol-component-of-apache"},{"cve":"CVE-2026-74757","slug":"cve-2026-74757-uncontrolled-resource-allocation-in-the-mcpack2pb-component-in","title":"Apache bRPC uncontrolled resource allocation in mcpack2pb","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:22.7+00:00","url":"https://junglewise.ai/threats/cve-2026-74757-uncontrolled-resource-allocation-in-the-mcpack2pb-component-in"},{"cve":"CVE-2026-74755","slug":"cve-2026-74755-an-integer-underflow-in-the-mcpack2pb-component-of-apache-brpc","title":"Apache bRPC integer underflow in mcpack2pb component","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:22.55+00:00","url":"https://junglewise.ai/threats/cve-2026-74755-an-integer-underflow-in-the-mcpack2pb-component-of-apache-brpc"},{"cve":"CVE-2026-66392","slug":"cve-2026-66392-apache-brpc-versions-before-1-18-0-validate-the-server","title":"Apache bRPC TLS certificate validation bypass","severity":"info","exploited":false,"published_at":"2026-10-21T12:17:22.417+00:00","url":"https://junglewise.ai/threats/cve-2026-66392-apache-brpc-versions-before-1-18-0-validate-the-server"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":35},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Apache Airflow","slug":"airflow","vulnerabilities":95,"url":"https://junglewise.ai/threats/technologies/airflow"},{"name":"Apache Camel","slug":"camel","vulnerabilities":87,"url":"https://junglewise.ai/threats/technologies/camel"},{"name":"Apache Tomcat","slug":"tomcat","vulnerabilities":87,"url":"https://junglewise.ai/threats/technologies/tomcat"},{"name":"Apache Thrift","slug":"thrift","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/thrift"},{"name":"Apache Ofbiz","slug":"ofbiz","vulnerabilities":67,"url":"https://junglewise.ai/threats/technologies/ofbiz"},{"name":"Apache HTTP Server","slug":"http-server","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/http-server"},{"name":"Apache Traffic Server","slug":"traffic-server","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/traffic-server"},{"name":"Apache Roller","slug":"roller","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/roller"},{"name":"Apache CloudStack","slug":"cloudstack","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/cloudstack"},{"name":"Apache ActiveMQ","slug":"activemq","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/activemq"},{"name":"Apache Apisix","slug":"apisix","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/apisix"},{"name":"Apache Wicket","slug":"apache-wicket","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/apache-wicket"}],"technology":{"hub":true,"name":"Apache Brpc","slug":"brpc","vendor":{"hub":true,"name":"Apache","slug":"apache","url":"https://junglewise.ai/threats/vendors/apache"},"aliases":[],"category":"framework","homepage":"https://brpc.apache.org/","repo_url":"https://github.com/apache/brpc","description":"Open-source remote procedure call framework for building distributed systems.","url":"https://junglewise.ai/threats/technologies/brpc"},"most_severe":[{"cve":"CVE-2025-59789","cvss":7.5,"epss":0.0161,"slug":"cve-2025-59789-uncontrolled-recursion-in-the-json2pb-component-in-apache-brpc","title":"Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote…","severity":"high","exploited":false,"published_at":"2025-12-01T11:15:48.377+00:00","url":"https://junglewise.ai/threats/cve-2025-59789-uncontrolled-recursion-in-the-json2pb-component-in-apache-brpc"},{"cve":"CVE-2026-90484","slug":"cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a","title":"Apache bRPC MySQL client null pointer dereference","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:56.59+00:00","url":"https://junglewise.ai/threats/cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a"},{"cve":"CVE-2026-87849","slug":"cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions","title":"Apache bRPC Discovery naming-service JSON parsing crash","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:04.603+00:00","url":"https://junglewise.ai/threats/cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions"},{"cve":"CVE-2026-86249","slug":"cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and","title":"brpc Server authentication bypass via internal_port","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:04.47+00:00","url":"https://junglewise.ai/threats/cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and"},{"cve":"CVE-2026-86147","slug":"cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource","title":"Apache bRPC path traversal and resource exhaustion in builtin services","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:04.317+00:00","url":"https://junglewise.ai/threats/cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource"},{"cve":"CVE-2026-86146","slug":"cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request","title":"Apache bRPC HTTP request/response smuggling in bundled parser","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:04.137+00:00","url":"https://junglewise.ai/threats/cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request"},{"cve":"CVE-2026-84748","slug":"cve-2026-84748-improper-authorization-in-apache-brpc-versions-1-18-0-on-all","title":"Apache bRPC improper authorization in protobuf protocol dispatch","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.997+00:00","url":"https://junglewise.ai/threats/cve-2026-84748-improper-authorization-in-apache-brpc-versions-1-18-0-on-all"},{"cve":"CVE-2026-84747","slug":"cve-2026-84747-interpretation-conflict-in-the-http-protocol-implementation-in","title":"Apache bRPC HTTP protocol interpretation conflict access control bypass","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.847+00:00","url":"https://junglewise.ai/threats/cve-2026-84747-interpretation-conflict-in-the-http-protocol-implementation-in"},{"cve":"CVE-2026-84727","slug":"cve-2026-84727-use-after-free-in-the-rtmp-protocol-implementation-in-apache-brpc","title":"Apache bRPC use-after-free in RTMP protocol implementation","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.697+00:00","url":"https://junglewise.ai/threats/cve-2026-84727-use-after-free-in-the-rtmp-protocol-implementation-in-apache-brpc"},{"cve":"CVE-2026-82953","slug":"cve-2026-82953-null-pointer-dereference-in-the-rtmp-protocol-implementation-in","title":"Apache bRPC NULL pointer dereference in RTMP createStream","severity":"info","exploited":false,"published_at":"2026-10-21T13:20:03.56+00:00","url":"https://junglewise.ai/threats/cve-2026-82953-null-pointer-dereference-in-the-rtmp-protocol-implementation-in"}],"generated_at":"2026-11-12T03:07:00.164048+00:00"}