CVE-2026-84747

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description An interpretation conflict in the HTTP protocol implementation allows remote attackers to bypass access control rules enforced by a front proxy. The FindMethodPropertyByURI() function splits the request path using a string splitter that skips empty fields. Consequently, paths with consecutive slashes (empty path segments), such as //flags, are treated as the collapsed form /flags. Because a front proxy enforcing an Access Control List (ACL) may only match the collapsed form, it may forward the padded literal to the bRPC server, which then dispatches it to the restricted service. Additionally, the HTTP/2 implementation fails to validate the :path pseudo-header, allowing requests that do not begin with / or are not the asterisk-form * to be processed, contrary to RFC 9113.

Recommendations Update Apache bRPC to version 1.18.0. Apply the official patch provided in pull request 3512. As a mitigation for deployments requiring the previous lenient behavior, enable the -http allow empty path segments gflag, although this is not recommended for servers exposed to untrusted traffic.