CVE-2026-61916: Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit set.
Root Cause: Two 256-entry lookup tables are accessed through pointers biased by 128 so that valid indices are in the range -128 to 127. Input bytes are promoted from plain char to int without first normalizing them to the signed-char range. On affected platforms, bytes in the range 0x80 to 0xFF therefore become indices 128 to 255 and read up to 127 bytes beyond the end of the underlying tables.
Affected Scenarios: A remotely accessible bRPC HTTP server on an affected platform can reach the vulnerable URL lookup through an unauthenticated request URI containing a high-bit byte. The case-insensitive lookup is also reachable when untrusted header names are processed through APIs such as the HTTP/2 HPACK path. HTTP/1 header names containing high-bit bytes are rejected by the HTTP/1 parser before reaching the vulnerable lookup. Builds where plain char is signed, which commonly include x8664 builds, are not affected by this issue.
How to Fix: Choose one of the following options: 1. Upgrade Apache bRPC to version 1.18.0 or later. 2. Apply the patch from https://github.com/apache/brpc/pull/3376 .
The fix normalizes lookup-table indices to the signed-char range before accessing the biased tables.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
Remote exposure applies to bRPC HTTP servers running a version before 1.18.0 on a platform where plain char is unsigned, such as ARM64. Builds where plain char is signed, commonly including x86_64 builds, are not described as affected.
Does exploitation require authentication or a valid HTTP/1 header name?
No authentication is required to reach the URL lookup: an attacker can send a request URI containing a byte from 0x80 through 0xFF. HTTP/1 header names with high-bit bytes are rejected before the vulnerable case-insensitive lookup, but untrusted header names processed through paths such as HTTP/2 HPACK can reach it.
What should be done if the service cannot be patched immediately?
Limit untrusted remote access to affected bRPC HTTP servers and prevent requests containing high-bit bytes in request URIs from reaching them. Also review exposure of HTTP/2 and other paths that process untrusted header names.
How can teams identify affected instances?
Identify bRPC deployments older than 1.18.0, then determine whether their target platform uses unsigned plain char. Prioritize instances that accept remote HTTP requests or process untrusted HTTP/2 header names.