THE Apache Software Foundation has released Apache bRPC 1.18.0 to patch 35 newly disclosed vulnerabilities, including 16 rated high severity and 19 moderate. The fixes address authentication bypass, memory corruption, and remote denial of service across multiple parsers and protocols.
Among the confirmed CVEs, notable examples include CVE-2026-48830, CVE-2026-86249, CVE-2026-78334, CVE-2026-84747, CVE-2026-86146, CVE-2026-86147, CVE-2026-54425, CVE-2026-54426, CVE-2026-54427, CVE-2026-56388, CVE-2026-74758, CVE-2026-84727, and CVE-2026-82230, with several additional memory- and stack-related flaws noted. The release also clarifies that version 1.18.0 itself is not affected, while the majority of disclosed flaws impacted earlier releases through 1.17.0.
Affected versions include 1.11.0 through 1.17.0 for certain CVEs, notably CVE-2026-79704, whereas 1.18.0 remains unaffected. The breadth of the bugs spans HTTP/1.1, HTTP/2, Redis, RTMP, mcpack2pb, Thrift and MySQL parsers, enabling issues such as authentication state leakage, proxy ACL bypasses, HTTP request smuggling, and memory exhaustion.
Administrators are strongly advised to upgrade to 1.18.0 at once or apply the individual patches referenced in the advisory if upgrading is not immediately feasible. The fixes enforce stricter recursion limits, tighter memory allocation boundaries, and per-request authentication validation to mitigate the reported risks. Organisations should review exposed endpoints and consider restricting access to builtin services during interim mitigations.
The advisory notes that while no public PoCs or active exploitation were confirmed at the time of disclosure, the fixes are essential to reduce exposure across affected deployments. The update was published on 22 October 2026.