{"id":"CVE-2026-61916","kind":"vulnerability","aliases":["CVE-2026-61916"],"related":[],"title":"bRPC: high-bit URL bytes crash the server on ARM64","description":"Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit set.\n\nRoot Cause:\nTwo 256-entry lookup tables are accessed through pointers biased by 128 so that valid indices are in the range -128 to 127. Input bytes are promoted from plain char to int without first normalizing them to the signed-char range. On affected platforms, bytes in the range 0x80 to 0xFF therefore become indices 128 to 255 and read up to 127 bytes beyond the end of the underlying tables.\n\nAffected Scenarios:\nA remotely accessible bRPC HTTP server on an affected platform can reach the vulnerable URL lookup through an unauthenticated request URI containing a high-bit byte. The case-insensitive lookup is also reachable when untrusted header names are processed through APIs such as the HTTP/2 HPACK path. HTTP/1 header names containing high-bit bytes are rejected by the HTTP/1 parser before reaching the vulnerable lookup. Builds where plain char is signed, which commonly include x86_64 builds, are not affected by this issue.\n\nHow to Fix:\nChoose one of the following options:\n1. Upgrade Apache bRPC to version 1.18.0 or later.\n2. Apply the patch from  https://github.com/apache/brpc/pull/3376 .\n\nThe fix normalizes lookup-table indices to the signed-char range before accessing the biased tables.","summary":"Apache bRPC reads past the end of two lookup tables when a request contains bytes with the high bit set, on platforms where plain char is unsigned such as ARM64. An remote attacker can crash the process, causing denial of service.","severity":"unknown","cvss":null,"epss":0.00202,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-brpc","arm64","http-server","http2","package"],"not_affected_if":["http1-only","no-network-exposure","x86_64-build"],"how_to_check":"- Check the bRPC version in use against `1.18.0`.\n- Determine whether the build target is ARM64 or another platform where plain char is unsigned; x86_64 builds are not affected per the sources.\n- Check whether the server is an HTTP server reachable from untrusted clients, or uses HTTP/2 HPACK with untrusted header names.","fix":"- Upgrade Apache bRPC to `1.18.0` or later.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3376.","status":"open","published_at":"2026-10-21T12:17:22+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:43+00:00","updated_at":"2026-10-25T05:02:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0` or later.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3376.","reach":"internet","title":"bRPC: high-bit URL bytes crash the server on ARM64","impact":"low","summary":"Apache bRPC reads past the end of two lookup tables when a request contains bytes with the high bit set, on platforms where plain char is unsigned such as ARM64. An remote attacker can crash the process, causing denial of service.","category":"package","nicknames":[],"who_cares":["apache-brpc","arm64","http-server","http2"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote crash of the bRPC server process causing denial of service.","analyst_note":"","how_to_check":"- Check the bRPC version in use against `1.18.0`.\n- Determine whether the build target is ARM64 or another platform where plain char is unsigned; x86_64 builds are not affected per the sources.\n- Check whether the server is an HTTP server reachable from untrusted clients, or uses HTTP/2 HPACK with untrusted header names.","needs_analyst":false,"not_affected_if":["x86_64-build","http1-only","no-network-exposure"],"who_is_affected":"Affected systems are remotely reachable bRPC HTTP servers built on platforms where plain char is unsigned, such as ARM64. Exposure also applies where untrusted header names pass through the case-insensitive lookup, such as the HTTP/2 HPACK path. HTTP/1 header names with high-bit bytes are rejected earlier, and x86_64 builds where plain char is signed are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":3802,"output_tokens":618,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-128':143C '-2026':13A,16A '-61916':14A,17A '/apache/brpc/pull/3376':307C '0x80':172C '0xff':174C '1':291C '1.18.0':87C,297C '127':145C,185C '128':134C,178C '2':300C '255':180C '256':124C '64':274C 'access':129C,198C,322C 'affect':166C,194C,204C,278C 'allow':98C 'also':229C 'apach':19B,27B,83C,293C 'apache-brpc':18B 'api':238C 'appli':301C 'arm64':11A,21B,56B,97C 'attack':59B,100C 'becom':176C 'beyond':187C 'bias':132C,324C 'bit':4A,45B,119C,221C,251C 'bound':71C 'brpc':1A,20B,28B,84C,199C,294C 'build':264C,275C 'byte':6A,41B,115C,147C,168C,186C,222C,252C 'case':78C,225C 'case-insensit':77C,224C 'caus':64B,102C,122C 'char':51B,92C,152C,163C,267C,319C 'choos':285C 'common':271C 'contain':40B,114C,217C,248C 'craft':112C 'crash':7A,61B,105C 'cve':12A,15A 'denial':65B,107C 'end':32B,189C 'entri':125C 'first':156C 'fix':284C,309C 'follow':289C 'github.com':306C 'github.com/apache/brpc/pull/3376':305C 'header':80C,233C,246C 'high':3A,44B,118C,220C,250C 'high-bit':2A,219C,249C 'hpack':243C 'http':23B,200C 'http-server':22B 'http/1':245C,257C 'http/2':242C 'http2':25B 'includ':272C 'indic':138C,177C,314C 'input':113C,146C 'insensit':79C,226C 'int':154C 'issu':281C 'later':299C 'lookup':35B,81C,126C,211C,227C,263C,312C 'lookup-t':311C 'name':234C,247C 'normal':157C,310C 'one':286C 'option':290C 'out-of-bound':68C 'packag':26B 'pars':75C 'parser':258C 'past':30B 'patch':303C 'path':244C 'plain':50B,91C,151C,266C 'platform':48B,89C,167C,205C 'pointer':131C 'process':63B,104C,236C 'promot':149C 'rang':142C,164C,171C,320C 'reach':207C,260C 'reachabl':230C 'read':29B,72C,182C 'reject':254C 'remot':58B,99C,197C 'request':39B,215C 'root':121C 'scenario':195C 'send':111C 'server':9A,24B,201C 'servic':67B,109C 'set':46B,120C 'sign':162C,269C,318C 'signed-char':161C,317C 'tabl':36B,127C,193C,313C,325C 'therefor':175C 'two':34B,123C 'unauthent':214C 'under':192C 'unsign':53B,94C 'untrust':232C 'upgrad':292C 'uri':216C 'url':5A,74C,210C 'valid':137C 'version':86C,296C 'vulner':209C,262C 'without':155C 'x86':273C","nicknames":[],"mitigations":[],"who_affected":"Affected systems are remotely reachable bRPC HTTP servers built on platforms where plain char is unsigned, such as ARM64. Exposure also applies where untrusted header names pass through the case-insensitive lookup, such as the HTTP/2 HPACK path. HTTP/1 header names with high-bit bytes are rejected earlier, and x86_64 builds where plain char is signed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61916","severity":null,"published_at":"2026-10-21T12:17:22+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-61916","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61916","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}