DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

5,197 Apache bRPC servers, and the clients a scan will never count

#zoomeye #apachebrpc #rpc #cve202648830

5,197 Apache bRPC servers, and the clients a scan will never count

Apache released bRPC 1.18.0 to fix 35 newly disclosed vulnerabilities in the framework: 16 rated high and 19 moderate. A ZoomEye search for app="Apache bRPC" returned 5,197 matching assets on 22 October 2026 at 05:36 UTC. The gap between what the number measures and what the advisory describes is the substance of this article.

The measurement

The query and the search link are recorded in the references. 5,197 is a count of assets whose fingerprint ZoomEye identifies as Apache bRPC, collected at a stated time.
An RPC framework serves two roles. An internet-facing scanner observes the role that listens on a port. The client role initiates connections from inside an application, and no external scan can enumerate it. The advisory covers both: it describes flaws in protocol parsers that a server exposes and flaws in a client's handling of responses from a peer.
The vulnerability report states that these flaws expose unpatched servers and clients to process crashes, memory exhaustion and unauthorised endpoint access. Only the first half of that sentence is measurable from outside.

What the 35 flaws cover

The affected surface spans multiple protocol parsers: HTTP/1.1, HTTP/2, Redis, RTMP, mcpack2pb, Thrift and MySQL. Almost all of the disclosed vulnerabilities affect versions through 1.17.0, and CVE-2026-79704 specifically affects 1.11.0 through 1.17.0. Version 1.18.0 is unaffected.
The authentication and access-control group is the part that most resembles a service exposure problem:

  • CVE-2026-48830 allows unauthenticated attackers to bypass authentication on protected HTTP endpoints. When a client sends a built-in HTTP request first over an HTTP/1.1 keep-alive connection, the socket remains marked as authenticated for subsequent requests.
  • CVE-2026-86249 latches authentication states on internal ports.
  • CVE-2026-78334 bypasses authentication hooks for streaming RPC frames.
  • CVE-2026-84747 and CVE-2026-86146 enable proxy ACL bypasses and HTTP request smuggling.
  • CVE-2026-86147 lets attackers truncate arbitrary files through the /flags built-in service. The keep-alive detail in CVE-2026-48830 deserves a second reading, because it describes a state that outlives a single request. A socket marked authenticated stays marked authenticated for later requests on the same connection, which is a property of connection reuse rather than of any single payload. Memory corruption and resource exhaustion form the second group. CVE-2026-56388 causes an out-of-bounds write in the Redis command parser when processing an empty RESP array header. CVE-2026-74758 and CVE-2026-84727 trigger heap use-after-free conditions in RTMP Abort message handling. Unbounded recursion appears in the HTTP/2 HPACK decoder (CVE-2026-54425), the Redis reply parser (CVE-2026-54426), the AMF parser (CVE-2026-54427) and the mcpack2pb parser (CVE-2026-82230). CVE-2026-78058 and CVE-2026-78066 enable unbounded memory allocation through crafted HTTP/2 frames and compressed payloads. Each of those parser names describes code that runs on both sides of a connection. A client parsing a response from a peer exercises the same parser logic as a server parsing a request.

Why a server count is still worth collecting

A partial measurement still has uses. It supports three specific claims.
First, it establishes that bRPC endpoints are internet-visible in numbers large enough that affected deployments plausibly exist beyond the owner's own inventory. The reporting notes that exact global deployment numbers are not specified in the vendor advisory, which is precisely why an independent measurement adds something.
Second, repeating the query later gives a trend. If the 5,197 falls while the advisory is public, that is evidence of patching or of fingerprint drift, and the two possibilities are distinguishable by checking whether the dork still matches the current release as well as the old ones.
Third, matching the external population against an internal asset list converts an abstract advisory into a list of hosts. That is the only step that produces remediation work.

The mitigation that follows from the mechanism

The Apache bRPC team resolved all 35 issues in 1.18.0 by enforcing strict recursion depths, bounding memory allocations and validating authentication per request. That last phrase is the structural fix for the keep-alive bypass: authentication validated per request rather than per connection.
For teams that cannot upgrade immediately, the reporting offers two options: apply the individual GitHub pull request patches referenced in the advisory, and restrict public access to built-in services.
The second option deserves emphasis because it addresses the /flags file-truncation flaw and the built-in HTTP endpoint family directly. A framework's built-in administrative services rarely need to be reachable from outside a trusted network, and restricting them reduces exposure without waiting for a release cycle.

Internal clients: the part of the estate an internet scan misses

An organisation running bRPC will typically have far more clients than servers. Clients live inside microservices, batch jobs and internal tools. None of them answers a public scanner.
That asymmetry means 5,197 is not a proxy for total affected deployments, and a patching plan built only on external exposure will leave most affected components untouched. The internal inventory question is which services depend on bRPC and which version each one bundles, including the transitive dependency in an application that never exposes an RPC port.

What the reporting does not establish

The reporting does not state how many deployments exist, whether any of these vulnerabilities has been exploited, or how reachable the built-in services are in typical deployments. No public proof of concept has been confirmed and no active exploitation in the wild has been reported. The 5,197 figure counts fingerprint matches at one point in time and says nothing about version.

References

Top comments (0)