Out-of-bounds read in Apache bRPC - CVE-2026-61916
Published: October 23, 2026
Vulnerability identifier: #VU157345
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-61916
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC process.
The vulnerability exists due to out-of-bounds reads in Apache bRPC's URL parsing and case-insensitive header lookup tables when high-bit input bytes are promoted to indices on platforms where plain char is unsigned. A remote attacker can send a request URI or applicable header names containing bytes from 0x80 to 0xFF to access memory beyond the biased lookup tables and crash the process.
Affected software
Apache bRPC
How to mitigate CVE-2026-61916
Install security update from vendor's website.
Apache bRPC - update to 1.18.0