Description
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.

Root Cause:
The bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:
1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC's framing while the reported field name contains the trailing space.
2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).
3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC's framing while a front-end that does not unfold sees a different message.
4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it.
5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.

Affected Scenarios:
bRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3521

Note:
After applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected.
Published: 2026-10-21
Score: n/a
EPSS: n/a
KEV: No
Impact: HTTP Request Smuggling and Header Injection
Action: Upgrade Now
AI Analysis

Impact

The vulnerability arises from Apache bRPC’s lenient parsing of HTTP/1.1 headers, allowing attackers to confuse the bRPC server and an upstream proxy or load balancer that interpret the same request bytes differently. This discrepancy enables request smuggling and the injection of arbitrary headers such as Authorization or X-Forwarded-For through chunked trailers, effectively bypassing front‑end validation and authentication controls. The weakness is a classic instance of HTTP request smuggling (CWE‑444).

Affected Systems

All installations of Apache bRPC prior to version 1.18.0 on any platform are affected. The flaw manifests when the bRPC server or client communicates over HTTP/1.1 behind a front‑proxy, load balancer, or any independently parsing peer, making it relevant for typical deployment scenarios where bRPC is not the sole HTTP parser.

Risk and Exploitability

Exploitability requires network access to the front‑end and the ability to send crafted HTTP/1.1 requests. While no EPSS score is reported, the absence of a KEV listing does not diminish the potential impact. A successful exploitation could allow an attacker to inject privileged headers, smuggle additional requests, or desynchronize client and server state, thereby facilitating privilege escalation, denial of service, or other downstream attacks. Given the lack of mitigation on the front‑end side and the high logical impact of request smuggling, the risk level should be treated as high.

Generated by OpenCVE AI on October 21, 2026 at 18:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0, which implements strict header parsing and drops chunked trailers containing spoofed headers.
  • If an immediate upgrade is not possible, apply the security patch available at https://github.com/apache/brpc/pull/3521 to enforce the same corrections.
  • As an interim configuration safeguard, set the gflags http_allow_obs_fold=false and http_strict_header_token=true to reject folding of Content‑Length/Transfer‑Encoding values and spaces in header field names, respectively.

Generated by OpenCVE AI on October 21, 2026 at 18:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently. Root Cause: The bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC: 1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC's framing while the reported field name contains the trailing space. 2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js). 3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC's framing while a front-end that does not unfold sees a different message. 4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it. 5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync. Affected Scenarios: bRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3521 Note: After applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected.
Title Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
Weaknesses CWE-444
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-21T12:15:26.421Z

Reserved: 2026-09-05T07:10:31.972Z

Link: CVE-2026-86146

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T13:20:04.137

Modified: 2026-10-21T13:20:04.137

Link: CVE-2026-86146

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T18:30:14Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')