CVE-2026-86147

External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the process-wide CPU/contention profiler for an arbitrarily long time. Root Cause: 1. The builtin /flags service allows gflags carrying a validator to be modified at runtime via ?setvalue=. The bvar/mbvar dump path gflags (bvar_dump_file, bvar_dump_tabs, mbvar_dump_file) were registered with an accept-anything validator whose only purpose was to wake the dumping thread. A remote attacker could therefore repoint the dump path (e.g. GET /flags/bvar_dump_file?setvalue=/victim/dir/target followed by GET /flags/bvar_dump?setvalue=true, or the equivalent for mbvar_dump_file, which is used verbatim without a forced suffix), making the dumping thread recursively create directories and open/truncate files at attacker-chosen locations. Tab names in bvar_dump_tabs were appended to the path without sanitization, allowing '..' to escape the configured directory. 2. The /pprof builtin service did not clamp the ?seconds= parameter to FLAGS_max_profiling_seconds (a limit that /hotspots enforced). A single request such as ?seconds=2147483647 made the handler sleep for decades while holding the process-wide gperftools CPU profiler or bthread contention profiler, so /hotspots/cpu and /hotspots/contention returned 503 for everyone else during that time. Affected Scenarios: Any Apache bRPC server exposing the builtin services (enabled by default on the same port as normal RPC traffic) to untrusted networks. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3523 Note: After the fix, bvar_dump_file, bvar_dump_tabs and mbvar_dump_file can no longer be modified at runtime through the /flags builtin service. They can still be changed programmatically via google::SetCommandLineOption(), taking effect on the next dump cycle. The profiling duration of /pprof is now capped by the -max_profiling_seconds gflag (default 300 seconds), which can be adjusted by the server owner.

• CWE-73
• CWE-400

• https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86141xmlregexp in libxml2 before 2.15.4 has a NULL pointer derefe…3.3
• CVE-2026-86142In libxml2 before 2.15.4, there is a heap-based buffer overf…7.8
• CVE-2026-86143In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOu…7.3
• CVE-2026-86144In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and…7.8
• CVE-2026-86145PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds wr…8.2
• CVE-2026-86146Inconsistent interpretation of HTTP requests (HTTP request/r…7.5
• CVE-2026-86148A security flaw has been discovered in Tenda CP3 27.5.57.101…9.1
• CVE-2026-86149A weakness has been identified in Tenda CP3 27.5.57.101. Thi…9.1
• CVE-2026-8615The Reviso Exporter for WooCommerce plugin for WordPress is …4.3
• CVE-2026-86150A security vulnerability has been detected in Tenda CP3 27.5…4.1
• CVE-2026-86151A vulnerability was detected in Tenda CP3 27.5.57.101. The a…9.1
• CVE-2026-86152A flaw has been found in Tenda CP3 27.5.57.101. The impacted…10