CVE-2024-23452

Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description： The http_parser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a Transfer-Encoding and a Content-Length header field, such a message might indicate an attempt to perform request smuggling or response splitting. One particular attack scenario is that a bRPC made http server on the backend receiving requests in one persistent connection from frontend server that uses TE to parse request with the logic that 'chunk' is contained in the TE field. in that case an attacker can smuggle a request into the connection to the backend server.  Solution: You can choose one solution from below: 1. Upgrade bRPC to version 1.8.0, which fixes this issue. Download link: https://github.com/apache/brpc/releases/tag/1.8.0 2. Apply this patch:  https://github.com/apache/brpc/pull/2518

• CWE-444

• http://www.openwall.com/lists/oss-security/2024/02/08/1Mailing List, Third Party Advisory
• https://github.com/apache/brpc/pull/2518Patch
• https://github.com/apache/brpc/releases/tag/1.8.0Release Notes
• https://lists.apache.org/thread/kkvdpwyr2s2yt9qvvxfdzon012898vxdIssue Tracking, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/02/08/1Mailing List, Third Party Advisory
• https://github.com/apache/brpc/pull/2518Patch
• https://github.com/apache/brpc/releases/tag/1.8.0Release Notes
• https://lists.apache.org/thread/kkvdpwyr2s2yt9qvvxfdzon012898vxdIssue Tracking, Vendor Advisory

Published

Feb 8, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23447An issue was discovered in the Windows Network Drive Connect…6.5
• CVE-2024-23448An issue was discovered whereby APM Server could log at ERRO…7.5
• CVE-2024-23449An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1…5.3
• CVE-2024-2345The FileBird – WordPress Media Library Folders & File Manage…5.4
• CVE-2024-23450A flaw was discovered in Elasticsearch, where processing a d…7.5
• CVE-2024-23451Incorrect Authorization issue exists in the API key based se…6.5
• CVE-2024-23453Android Spoon application version 7.11.1 to 8.6.0 uses hard-…5.5
• CVE-2024-23454Apache Hadoop’s RunJar.run() does not set permissions for te…6.2
• CVE-2024-23456Anti-tampering can be disabled under certain conditions with…7.5
• CVE-2024-23457The anti-tampering functionality of the Zscaler Client Conne…7.8
• CVE-2024-23458While copying individual autoupdater log files, reparse poin…7.8
• CVE-2024-23459An Improper Link Resolution Before File Access ('Link Follow…9.8