{"id":"CVE-2026-86146","kind":"vulnerability","aliases":["CVE-2026-86146"],"related":[],"title":"Apache bRPC: HTTP parser flaws allow request smuggling behind proxies","description":"Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\n\nRoot Cause:\nThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\n1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC's framing while the reported field name contains the trailing space.\n2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\n3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC's framing while a front-end that does not unfold sees a different message.\n4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it.\n5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\n\nAffected Scenarios:\nbRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3521 \n\nNote:\nAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected.","summary":"Apache bRPC before 1.18.0 parses some HTTP/1.1 framing headers differently from a front proxy or load balancer. A remote attacker can smuggle requests, forge headers such as Authorization or X-Forwarded-For through chunked trailers, or desynchronize responses.","severity":"high","cvss":null,"epss":0.00203,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brpc","c++","http","load-balancer","package","proxy"],"not_affected_if":["brpc-1.18.0-or-later","direct-binary-protocol-only","no-http1-front-end"],"how_to_check":"- Check the bRPC version in use; affected versions are below `1.18.0`.\n- Confirm whether bRPC serves HTTP/1.1 traffic that passes through a proxy or load balancer.\n- Review the proxy and bRPC handling of `Transfer-Encoding` and `Content-Length` headers.","fix":"- Upgrade Apache bRPC to `1.18.0` or later.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3521.\n- After upgrading, set `http_allow_obs_fold=true` only if legacy clients need folded Content-Length or Transfer-Encoding values, and `http_strict_header_token=true` to reject spaces in header names.","status":"open","published_at":"2026-10-21T13:20:04+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:23+00:00","updated_at":"2026-10-25T05:02:23+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:02:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0` or later.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3521.\n- After upgrading, set `http_allow_obs_fold=true` only if legacy clients need folded Content-Length or Transfer-Encoding values, and `http_strict_header_token=true` to reject spaces in header names.","reach":"internet","title":"Apache bRPC: HTTP parser flaws allow request smuggling behind proxies","impact":"medium","summary":"Apache bRPC before 1.18.0 parses some HTTP/1.1 framing headers differently from a front proxy or load balancer. A remote attacker can smuggle requests, forge headers such as Authorization or X-Forwarded-For through chunked trailers, or desynchronize responses.","category":"package","nicknames":[],"who_cares":["bRPC","http","proxy","load-balancer","c++"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker smuggles requests and forges trusted headers past the proxy","analyst_note":"","how_to_check":"- Check the bRPC version in use; affected versions are below `1.18.0`.\n- Confirm whether bRPC serves HTTP/1.1 traffic that passes through a proxy or load balancer.\n- Review the proxy and bRPC handling of `Transfer-Encoding` and `Content-Length` headers.","needs_analyst":false,"not_affected_if":["bRPC-1.18.0-or-later","no-http1-front-end","direct-binary-protocol-only"],"who_is_affected":"Teams running bRPC servers or clients that speak HTTP/1.1 with a front proxy, load balancer, or any other peer that parses messages independently. Exposure depends on the front-end accepting the same malformed requests that bRPC accepts. Deployments that use bRPC only over other protocols, or without an intermediary parser, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4231,"output_tokens":711,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':225C '-2026':12A,15A '-32213':226C '-86146':13A,16A '/apache/brpc/pull/3521':444C '/transfer-encoding':489C '1':157C,202C,216C,428C '1.18.0':28B,81C,433C '13':209C '2':189C,438C '3':203C,229C '3.2.4':238C '4':272C '5':170C,323C '7230':237C 'abl':388C 'accept':119C,172C,249C,483C 'act':121C 'addit':497C 'affect':363C 'allow':6A,85C,478C 'apach':1A,25B,78C 'appli':439C,447C 'attack':44B,87C,387C 'author':52B,315C,408C 'balanc':22B,41B,103C,377C 'behind':9A,98C 'brpc':2A,17B,26B,79C,95C,113C,156C,177C,207C,256C,365C,430C 'bundl':74C 'byte':108C 'c':18B 'callback':282C 'caus':111C,360C 'choos':422C 'chunk':59B,273C,308C,339C,344C,359C,414C,460C 'class':222C 'client':368C,513C 'close':355C 'colon':162C 'comma':333C 'communic':369C 'compat':476C 'conform':129C 'connect':354C 'contain':185C 'content':168C,195C,200C,241C,487C 'content-length':167C,194C,199C,240C,486C 'cve':11A,14A,224C 'decid':510C 'default':458C 'deploy':97C 'desync':362C 'desynchron':62B,398C,417C 'differ':34B,109C,137C,149C,270C 'drive':176C,255C 'drop':463C 'e.g':166C,198C,334C,407C 'either':133C 'encod':246C,326C,337C 'end':132C,154C,214C,263C,300C,396C 'fed':277C 'field':183C,275C,312C,503C 'fix':421C,435C,449C 'flaw':5A 'fold':232C,235C,252C,480C,485C 'follow':426C 'forg':48B,405C 'fork':114C 'form':126C,453C,520C 'forward':56B,319C,411C 'four':451C 'frame':32B,140C,164C,179C,253C,258C,511C 'front':37B,131C,153C,213C,262C,299C,374C,395C 'front-end':130C,152C,212C,261C,298C,394C 'gflag':472C 'github.com':443C 'github.com/apache/brpc/pull/3521':442C 'gzip':338C 'header':33B,49B,93C,125C,143C,165C,281C,285C,292C,296C,304C,406C,452C,469C,494C,502C 'http':3A,19B,67C,69C,117C,477C,492C 'http-parser':116C 'http/1.1':31B,75C,124C,371C 'inconsist':64C 'independ':385C 'inject':92C 'insid':192C,500C 'inspect':302C 'instead':356C,464C 'interior':190C 'interpret':65C,136C 'issu':437C 'legitim':512C 'length':169C,196C,201C,242C,488C 'like':294C 'line':231C 'list':327C 'load':21B,40B,102C,376C 'load-balanc':20B 'map':293C,470C 'merg':289C,466C 'messag':147C,220C,271C,384C 'name':184C,504C 'node.js':228C 'note':445C 'ob':234C,479C 'obs-fold':233C 'obsolet':230C,519C 'one':423C,508C 'option':329C,427C 'packag':23B 'pars':29B,105C,382C 'parser':4A,76C,118C,401C 'past':321C 'patch':441C 'peer':380C 'platform':84C 'provid':474C 'proxi':10A,24B,38B,100C,375C 'read':208C,215C,352C 'real':295C 'recogn':342C 'reject':134C,218C,348C,456C,498C 'remot':43B,86C 'report':182C 'request':7A,47B,68C,90C,309C,346C,391C,404C 'request/response':70C 'respons':63B,350C,361C,418C 'restor':482C 'rfc':236C 'root':110C 'scenario':364C 'section':286C,305C 'see':268C 'send':390C 'server':366C 'set':144C 'sever':123C 'skip':205C 'smuggl':8A,46B,71C,89C,311C,403C 'space':159C,188C,191C,499C 'still':175C 'strict':493C 'token':495C 'trail':187C 'trailer':60B,274C,415C,461C 'transfer':245C,325C,336C 'transfer-encod':244C,324C,335C 'true':481C,496C 'two':400C,471C 'unaffect':522C 'unfold':267C 'upgrad':429C 'use':517C 'valu':174C,197C,247C,254C,490C 'version':80C,432C 'via':413C 'whitespac':330C 'x':55B,318C,410C 'x-forwarded-for':54B,317C,409C","nicknames":[],"mitigations":[],"who_affected":"Teams running bRPC servers or clients that speak HTTP/1.1 with a front proxy, load balancer, or any other peer that parses messages independently. Exposure depends on the front-end accepting the same malformed requests that bRPC accepts. Deployments that use bRPC only over other protocols, or without an intermediary parser, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:20:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86146","severity":null,"published_at":"2026-10-21T13:20:04+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-86146","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86146","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}