HTTP Request/Response Smuggling Vulnerability in Apache bRPC

CVE-2026-86146

What is CVE-2026-86146?

A vulnerability exists in Apache bRPC versions prior to 1.18.0 due to the inconsistent handling of HTTP requests. This allows attackers to exploit differences in parsing between the bRPC server and a front-end proxy or load balancer, potentially smuggling requests and injecting malicious headers. Specific forms of HTTP headers are accepted by bRPC that may be rejected by compliant HTTP front-ends, leading to desynchronized responses and header forgery. This issue can allow unauthorized access and manipulation of requests, emphasizing the need for immediate patching or upgrading to protect against potential exploits.

References