{"id":"CVE-2026-84747","aliases":[],"cve":{"records":[{"id":"CVE-2026-84747","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-02T08:58:24.479Z","published":"2026-10-21T12:13:28.033Z","modified":"2026-10-30T14:39:07.800Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-10-21T12:13:28.033Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T14:39:07.800Z"}],"references":[{"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-436","description":"CWE-436 Interpretation Conflict","source":"apache"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T14:38:39.421022Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments","titleSource":"apache","descriptionSource":"apache","description":"Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy.\n\nRoot Cause:\nThe method dispatch function FindMethodPropertyByURI() in bRPC's HTTP protocol splits the request path with a string splitter that skips empty fields, so paths containing empty path segments (consecutive slashes), such as //flags, /flags// and /flags//port, are dispatched to the same method as their collapsed form /flags. Per RFC 3986 these are distinct paths. A front proxy that enforces an ACL (e.g. blocking access to builtin services such as /flags) matches the collapsed form only, and therefore forwards the padded literal to the bRPC server, where it is dispatched as if it were the collapsed form. This differential allows //flags?setvalue= to reach a builtin service that /flags is not allowed to reach. Additionally, the HTTP/2 implementation never validated the :path pseudo-header, so requests without a :path, or with a :path that neither begins with '/' nor is the asterisk-form '*', contrary to RFC 9113 section 8.3.1, were not rejected.\n\nAffected Scenarios:\nDeployments of Apache bRPC behind a front proxy or gateway that performs access control (ACL) decisions on the literal request path, where the bRPC server accepts HTTP or HTTP/2 traffic from that proxy. In such deployments an attacker can send a path containing empty path segments to reach a resource that the front proxy intended to block.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3512 \n\nNote:\nAfter applying the fix, HTTP and HTTP/2 request paths containing empty path segments (consecutive slashes) are rejected by default, and HTTP/2 :path values that are empty or neither begin with '/' nor equal '*' are rejected. Deployments that depend on the previous lenient behavior can restore it by turning on the gflag -http_allow_empty_path_segments, which is not recommended for servers exposed to untrusted traffic.","score":7.5,"severity":"high","published":"2026-10-21T12:13:28.033Z","modified":"2026-10-30T14:39:07.800Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache bRPC","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.18.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:github/apache/brpc","cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-84747"}],"remediation":[],"references":["https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"],"sources":[{"name":"CVE","id":"CVE-2026-84747","modified":"2026-10-30T14:39:07.800Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-84747"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-30T16:16:26.717Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}