Apache bRPC implements request path parsing by collapsing consecutive slashes, treating paths like //flags as /flags. This divergence from RFC 3986 and RFC 9113 allows an attacker to send padded paths that bypass front‑proxy ACL rules intended to block services such as /flags. The flaw can also accept malformed HTTP/2 :path pseudo‑headers, which are normally rejected. As a result, a remote actor can reach resources that the proxy should have prevented access to, effectively gaining unauthorized access to internal services.

All versions of Apache bRPC older than 1.18.0 on any platform are affected when the server is exposed to HTTP or HTTP/2 traffic and a front proxy enforces ACLs based on literal request paths. The vulnerability impacts deployments behind proxies or gateways that do not account for empty path segments in their ACL checks.

The vulnerability can be triggered remotely without local privileges. While the CVSS score is not provided and the EPSS score is unavailable, the issue is not yet listed in CISA's KEV catalog. Attackers are likely to exploit the weakness by crafting URLs with empty path segments or submitting malformed :path pseudo‑headers in HTTP/2, thereby bypassing ACL rules and accessing protected resources. The impact is substantial because it breaks the intended isolation provided by the front proxy.