CVE-2026-86146

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description Inconsistent interpretation of HTTP requests in the bundled HTTP/1.1 parser allows remote attackers to smuggle requests and inject headers when the software is deployed behind a proxy or load balancer that parses bytes differently. This occurs because the parser accepts several HTTP/1.1 header forms that conforming front-ends may reject or interpret differently, leading to desynchronization between the two parsers. Technical details include the acceptance of spaces before colons in framing headers, skipping interior spaces within the Content-Length value, and accepting obsolete line folding (obs-fold) for Content-Length and Transfer-Encoding values. Additionally, chunked trailer fields are merged into the header map, potentially allowing the smuggling of fields such as Authorization or X-Forwarded-For. Furthermore, Transfer-Encoding lists with optional whitespace after a comma may not be recognized as chunked, causing response desynchronization.

Recommendations Upgrade Apache bRPC to version 1.18.0. Apply the official patch provided in pull request 3521. To restore acceptance of folded Content-Length or Transfer-Encoding values after patching, set the gflag http allow obs fold=true. To additionally reject spaces inside any header field name, set the gflag http strict header token=true.