Out-of-Bounds Read Vulnerability in Apache bRPC Affects ARM64 Platforms

CVE-2026-61916

What is CVE-2026-61916?

The identified issue in Apache bRPC involves out-of-bounds reads during URL parsing and case-insensitive header lookups on ARM64 platforms. Attackers can exploit this vulnerability by sending crafted requests with high-bit set bytes, potentially leading to process crashes and denial of service. The vulnerability exists due to improper handling of input bytes when accessing lookup tables, resulting in invalid memory accesses. Users are advised to upgrade to Apache bRPC version 1.18.0 or apply the necessary patch to mitigate the risks associated with this issue.

References