CVE-2026-84747 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache bRPC services, especially those with access control rules enforced by a front proxy, should assess exposure and verify the impact of HTTP request path manipulation.

Why it matters

Defenders should prioritize verifying exposure of Apache bRPC services, especially those with access control rules enforced by a front proxy, and assess the impact of HTTP request path manipulation. The vulnerability allows remote attackers to bypass access control rules, potentially leading to unauthorized access to builtin services. Evidence is limited to CVE and source item details; specific exploitation instances or versions beyond 1.18.0 are not established.

• Potential bypass of access control rules enforced by front proxies
• Possible unauthorized access to builtin services

Technical summary

Apache bRPC has a vulnerability allowing remote attackers to bypass access control rules enforced by a front proxy due to interpretation conflicts in the HTTP protocol implementation. The issue arises from the method dispatch function FindMethodPropertyByURI() splitting request paths with a string splitter that skips empty fields, leading to paths with empty segments being dispatched to the same method as their collapsed form.

Defensive priority

Defenders should prioritize verifying exposure of Apache bRPC services, especially those with access control rules enforced by a front proxy, and assess the impact of HTTP request path manipulation.

Recommended defensive actions

• Verify Apache bRPC services for exposure, especially those with access control rules enforced by a front proxy
• Assess the impact of HTTP request path manipulation on access control
• Update to Apache bRPC version 1.18.0 or later if possible
• Monitor for unusual HTTP request patterns
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in Apache bRPC, including the root cause and affected scenarios. However, the corpus does not establish versions beyond 1.18.0 or specific exploitation instances.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.