Vendor
Apache Software Foundation
3,000 known vulnerabilities.
Products
3,000 results · Feed
-
Critical 9.2
Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did …
-
Medium 6.5
Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (is_full_package), afte…
-
Medium 4.3
Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data/service members or…
-
Critical 9.1
Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a …
-
High 7.5
Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privilege…
-
High 7.5
Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a prox…
-
High 7.5
Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the public port. Root Cause: ServerOptions.internal_port is documented to make builtin services (and Tabbed services) reachab…
-
High 7.5
Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments
Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function FindMethodPropertyByURI()…
-
Medium 5.4
Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message
Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message. Root Cause: When processing an RTMP Abort (proto…
-
Medium 5.3
Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command. Root Cause: When an RTMP service rejects a crea…
-
High 7.5
Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the hands…
-
High 7.5
Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service
A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. Root Cause: When a Socket with health checking enabled fails, Socket::WaitAndReset closes its file de…
-
High 7.5
Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without cat…
-
High 7.5
Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser (used to serve nshead_mcpack / u…
-
High 7.5
Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame. Root Cause: When handling FRAME_TYPE_FEEDBACK frames, bRPC cal…
-
High 7.5
Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root…
-
High 7.5
Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to exhaust the memory of a server (denial of service) by sending an endless sequence of continuation data frames. Ro…
-
High 7.5
Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id f…
-
Critical 9.1
Apache bRPC: Missing Authentication for Streaming RPC Frames
Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause:…
-
High 7.5
Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory u…
-
High 7.5
Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: Th…
-
High 7.5
Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting …
-
High 7.5
Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. No authentication or application-level request is required. Root Cause: Wh…
-
High 7.5
Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root…
-
High 7.5
Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function co…
-
Medium 5.9
Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who…
-
High 7.5
Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input…
-
High 7.5
Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffe…
-
High 7.5
Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send …
-
Critical 9.1
Apache bRPC: Out-of-Bounds Write in Redis Command Parser
The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-o…
-
High 7.5
Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string l…
-
High 7.5
Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Caus…
-
High 7.5
Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which co…
-
High 7.5
Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforci…
-
High 7.5
Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded …
-
Critical 9.1
Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOpt…
-
High 8.8
Apache IoTDB: Legacy Pipe Privilege Escalation
The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA …
-
Critical 9.8
Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.
-
High 7.5
Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.
-
Critical 9.8
Apache IoTDB: Auth Bypass in pipeTransfer() interface
An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.