CVE Tools
Track your stack

Apache Brpc

41 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Apache Brpc, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Apache Brpc CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Apache Brpc CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-081
2025-090
2025-100
2025-110
2025-121
2026-011
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-1035
2026-110

Severity

How the 41 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical615%
  • High2971%
  • Medium615%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache Brpc.

  1. CVE-2026-90484Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash6.5
  2. CVE-2026-87849Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing4.3
  3. CVE-2026-86249Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth9.1
  4. CVE-2026-86147Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof7.5
  5. CVE-2026-86146Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing7.5
  6. CVE-2026-84748Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration7.5
  7. CVE-2026-84747Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments7.5
  8. CVE-2026-84727Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message5.4
  9. CVE-2026-82953Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service5.3
  10. CVE-2026-82942Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service7.5
  11. CVE-2026-82425Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service7.5
  12. CVE-2026-82231Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client7.5
  13. CVE-2026-82230Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser7.5
  14. CVE-2026-82210Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames7.5
  15. CVE-2026-81755Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request7.5

Product grouping is registry-driven, with AI assist and human review. How it works