Read the docs
TI-2024-15499 Aliases CVE-2024-23452GHSA-2862-59r4-c989

Apache bRPC: HTTP request smuggling vulnerability

Priority LOW 36CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description： The http_parser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a Transfer-Encoding and a Content-Length header field, such a message might indicate an attempt to perform request smuggling or response splitting. One particular attack scenario is that a bRPC made http server on the backend receiving requests in one persistent connection from frontend server that uses TE to parse request with the logic that 'chunk' is contained in the TE field. in that case an attacker can smuggle a request into the connection to the backend server.  Solution: You can choose one solution from below: 1. Upgrade bRPC to version 1.8.0, which fixes this issue. Download link: https://github.com/apache/brpc/releases/tag/1.8.0 2. Apply this patch:  https://github.com/apache/brpc/pull/2518

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01637 76th percentileScored 2026-11-07
Fix Fixed Apache bRPC (Apache Software Foundation): 1.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache bRPC0.9.5 to before 1.8.01.8.0Patch availableCNA
  • Apache bRPC VendorApache Affected 0.9.5 to before 1.8.0 Fixed in 1.8.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*0.9.5 to before 1.8.0VulnerableApache
  • cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:* Versions 0.9.5 to before 1.8.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache bRPC (Apache Software Foundation) Fixed in 1.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23452
  2. 2026-10-03 Alias added: GHSA-2862-59r4-c989

References

Patch 1

Advisory 2

Other 1

  • TI-2025-37397 Apache bRPC: Remote command injection vulnerability in heap builtin service CVSS 3.1CRITICAL 9.8
  • TI-2023-14776 Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution CVSS 3.1CRITICAL 9.8
  • TI-2025-37239 Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser CVSS 3.1HIGH 7.5
  • TI-2025-34269 Apache bRPC: Redis Parser Remote Denial of Service CVSS 3.1HIGH 7.5
  • TI-2023-24531 Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences