{"id":"CVE-2026-84747","kind":"vulnerability","aliases":["CVE-2026-84747"],"related":[],"title":"Apache bRPC: padded URL paths bypass front-proxy access control rules","description":"Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy.\n\nRoot Cause:\nThe method dispatch function FindMethodPropertyByURI() in bRPC's HTTP protocol splits the request path with a string splitter that skips empty fields, so paths containing empty path segments (consecutive slashes), such as //flags, /flags// and /flags//port, are dispatched to the same method as their collapsed form /flags. Per RFC 3986 these are distinct paths. A front proxy that enforces an ACL (e.g. blocking access to builtin services such as /flags) matches the collapsed form only, and therefore forwards the padded literal to the bRPC server, where it is dispatched as if it were the collapsed form. This differential allows //flags?setvalue= to reach a builtin service that /flags is not allowed to reach. Additionally, the HTTP/2 implementation never validated the :path pseudo-header, so requests without a :path, or with a :path that neither begins with '/' nor is the asterisk-form '*', contrary to RFC 9113 section 8.3.1, were not rejected.\n\nAffected Scenarios:\nDeployments of Apache bRPC behind a front proxy or gateway that performs access control (ACL) decisions on the literal request path, where the bRPC server accepts HTTP or HTTP/2 traffic from that proxy. In such deployments an attacker can send a path containing empty path segments to reach a resource that the front proxy intended to block.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3512 \n\nNote:\nAfter applying the fix, HTTP and HTTP/2 request paths containing empty path segments (consecutive slashes) are rejected by default, and HTTP/2 :path values that are empty or neither begin with '/' nor equal '*' are rejected. Deployments that depend on the previous lenient behavior can restore it by turning on the gflag -http_allow_empty_path_segments, which is not recommended for servers exposed to untrusted traffic.","summary":"Apache bRPC before 1.18.0 treats paths with empty segments such as //flags as the collapsed /flags when dispatching HTTP requests, while a front proxy checks only the literal path. A remote attacker can therefore reach builtin services the proxy was meant to block, such as /flags?setvalue=.","severity":"medium","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-brpc","c++","http","package","reverse-proxy","self-hosted"],"not_affected_if":["direct-exposure-only","no-front-proxy-acl","patched-1.18.0"],"how_to_check":"- Check the bRPC version in the deployed build, for example `grep -i brpc` in the dependency manifest or the version reported by the server.\n- Confirm whether a front proxy or gateway applies ACL rules to bRPC builtin paths such as `/flags`.\n- Send a request to `//flags` through the proxy and see whether the bRPC server answers it.","fix":"- Upgrade Apache bRPC to `1.18.0`.\n- Or apply the patch from https://github.com/apache/brpc/pull/3512.\n- Do not enable `-http_allow_empty_path_segments` on servers exposed to untrusted traffic.","status":"open","published_at":"2026-10-21T13:20:03+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:27+00:00","updated_at":"2026-10-25T05:02:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:02:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0`.\n- Or apply the patch from https://github.com/apache/brpc/pull/3512.\n- Do not enable `-http_allow_empty_path_segments` on servers exposed to untrusted traffic.","reach":"internet","title":"Apache bRPC: padded URL paths bypass front-proxy access control rules","impact":"medium","summary":"Apache bRPC before 1.18.0 treats paths with empty segments such as //flags as the collapsed /flags when dispatching HTTP requests, while a front proxy checks only the literal path. A remote attacker can therefore reach builtin services the proxy was meant to block, such as /flags?setvalue=.","category":"package","nicknames":[],"who_cares":["apache-brpc","c++","http","reverse-proxy","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reaches blocked builtin services, including flag-changing endpoints","analyst_note":"","how_to_check":"- Check the bRPC version in the deployed build, for example `grep -i brpc` in the dependency manifest or the version reported by the server.\n- Confirm whether a front proxy or gateway applies ACL rules to bRPC builtin paths such as `/flags`.\n- Send a request to `//flags` through the proxy and see whether the bRPC server answers it.","needs_analyst":false,"not_affected_if":["no-front-proxy-acl","direct-exposure-only","patched-1.18.0"],"who_is_affected":"Deployments of Apache bRPC that sit behind a proxy or gateway making access control decisions on the literal request path, and that accept HTTP or HTTP/2 traffic from that proxy. A bRPC server reached directly without such a proxy in front of it has no ACL to bypass, so the flaw does not change its exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4011,"output_tokens":680,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-84747':15A,18A '/apache/brpc/pull/3512':345C '/flags':42B,46B,76B,140C,141C,143C,155C,178C,208C,216C '/port':144C '1':329C '1.18.0':34B,89C,334C '2':339C '3986':158C '8.3.1':257C '9113':255C 'accept':288C 'access':10A,98C,172C,275C 'acl':169C,277C 'addit':222C 'affect':261C 'allow':93C,207C,219C,398C 'apach':1A,20B,31B,86C,265C 'apache-brpc':19B 'appli':340C,348C 'asterisk':250C 'asterisk-form':249C 'attack':62B,95C,300C 'begin':244C,375C 'behavior':388C 'behind':267C 'block':73B,171C,319C 'brpc':2A,21B,32B,87C,114C,192C,266C,286C,331C 'builtin':66B,174C,213C 'bypass':6A,97C 'c':22B 'caus':107C 'check':55B 'choos':323C 'collaps':45B,153C,181C,203C 'conflict':79C 'consecut':136C,360C 'contain':132C,305C,356C 'contrari':252C 'control':11A,99C,276C 'cve':13A,16A 'decis':278C 'default':365C 'depend':383C 'deploy':263C,298C,381C 'differenti':206C 'dispatch':48B,110C,146C,197C 'distinct':161C 'e.g':170C 'empti':38B,128C,133C,306C,357C,372C,399C 'enforc':101C,167C 'equal':378C 'expos':408C 'field':129C 'findmethodpropertybyuri':112C 'fix':322C,336C,350C 'follow':327C 'form':154C,182C,204C,251C 'forward':186C 'front':8A,53B,104C,164C,269C,315C 'front-proxi':7A 'function':111C 'gateway':272C 'gflag':396C 'github.com':344C 'github.com/apache/brpc/pull/3512':343C 'header':232C 'host':30B 'http':23B,49B,82C,116C,289C,351C,397C 'http/2':224C,291C,353C,367C 'implement':84C,225C 'intend':317C 'interpret':78C 'issu':338C 'lenient':387C 'liter':58B,189C,281C 'match':179C 'meant':71B 'method':109C,150C 'neither':243C,374C 'never':226C 'note':346C 'one':324C 'option':328C 'packag':24B 'pad':3A,188C 'patch':342C 'path':5A,36B,59B,121C,131C,134C,162C,229C,237C,241C,283C,304C,307C,355C,358C,368C,400C 'per':156C 'perform':274C 'platform':92C 'previous':386C 'protocol':83C,117C 'proxi':9A,27B,54B,69B,105C,165C,270C,295C,316C 'pseudo':231C 'pseudo-head':230C 'reach':65B,211C,221C,310C 'recommend':405C 'reject':260C,363C,380C 'remot':61B,94C 'request':50B,120C,234C,282C,354C 'resourc':312C 'restor':390C 'revers':26B 'reverse-proxi':25B 'rfc':157C,254C 'root':106C 'rule':12A,100C 'scenario':262C 'section':256C 'segment':39B,135C,308C,359C,401C 'self':29B 'self-host':28B 'send':302C 'server':193C,287C,407C 'servic':67B,175C,214C 'setvalu':77B,209C 'skip':127C 'slash':137C,361C 'split':118C 'splitter':125C 'string':124C 'therefor':64B,185C 'traffic':292C,411C 'treat':35B 'turn':393C 'untrust':410C 'upgrad':330C 'url':4A 'valid':227C 'valu':369C 'version':88C,333C 'without':235C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache bRPC that sit behind a proxy or gateway making access control decisions on the literal request path, and that accept HTTP or HTTP/2 traffic from that proxy. A bRPC server reached directly without such a proxy in front of it has no ACL to bypass, so the flaw does not change its exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:20:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84747","severity":null,"published_at":"2026-10-21T13:20:03+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84747","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84747","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}