Vulnerability-Lookup

CVE-2026-86146 (GCVE-0-2026-86146)

Vulnerability from cvelistv5 – Published: 2026-10-21 12:15 – Updated: 2026-10-30 14:40

Title

Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing

Summary

Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently. Root Cause: The bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC: 1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC's framing while the reported field name contains the trailing space. 2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js). 3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC's framing while a front-end that does not unfold sees a different message. 4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it. 5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync. Affected Scenarios: bRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3521 Note: After applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 14:40 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1170 records in the last 180 days details

References

1 reference

URL	Tags
https://lists.apache.org/thread/2pf15ojj0vr7rtx95…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache bRPC	Affected: 0 , < 1.18.0 (semver)	guessed

Credits

Claude

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-86146",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T14:40:46.501949Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T14:40:59.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "product": "Apache bRPC",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Claude"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version \u0026lt; 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\u003cbr\u003e\u003cbr\u003eRoot Cause:\u003cbr\u003eThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\u003cbr\u003e1. A space before the colon of framing headers (e.g. \u003ccode\u003eContent-Length : 5\u003c/code\u003e) is accepted; the value still drives bRPC\u0027s framing while the reported field name contains the trailing space.\u003cbr\u003e2. Interior spaces inside a \u003ccode\u003eContent-Length\u003c/code\u003e value (e.g. \u003ccode\u003eContent-Length: 1 3\u003c/code\u003e) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\u003cbr\u003e3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of \u003ccode\u003eContent-Length\u003c/code\u003e and \u003ccode\u003eTransfer-Encoding\u003c/code\u003e values is accepted, so a folded framing value drives bRPC\u0027s framing while a front-end that does not unfold sees a different message.\u003cbr\u003e4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as \u003ccode\u003eAuthorization\u003c/code\u003e or \u003ccode\u003eX-Forwarded-For\u003c/code\u003e past it.\u003cbr\u003e5. \u003ccode\u003eTransfer-Encoding\u003c/code\u003e lists with optional whitespace after a comma (e.g. \u003ccode\u003eTransfer-Encoding: gzip, chunked\u003c/code\u003e) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\u003cbr\u003e\u003cbr\u003eAffected Scenarios:\u003cbr\u003ebRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. \u003ccode\u003eAuthorization\u003c/code\u003e, \u003ccode\u003eX-Forwarded-For\u003c/code\u003e) via chunked trailers, or desynchronize responses.\u003cbr\u003e\u003cbr\u003eHow to Fix:\u003cbr\u003e(Choose one of the following options)\u003cbr\u003e1. Upgrade bRPC to version 1.18.0, which fixes this issue.\u003cbr\u003e2. Apply this patch: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3521\"\u003ehttps://github.com/apache/brpc/pull/3521\u003c/a\u003e\u003cbr\u003e\u003cbr\u003eNote:\u003cbr\u003eAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: \u003ccode\u003ehttp_allow_obs_fold=true\u003c/code\u003e restores acceptance of folded \u003ccode\u003eContent-Length\u003c/code\u003e/\u003ccode\u003eTransfer-Encoding\u003c/code\u003e values, and \u003ccode\u003ehttp_strict_header_token=true\u003c/code\u003e additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected."
            }
          ],
          "value": "Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version \u003c 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\n\nRoot Cause:\nThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\n1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC\u0027s framing while the reported field name contains the trailing space.\n2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\n3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC\u0027s framing while a front-end that does not unfold sees a different message.\n4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it.\n5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\n\nAffected Scenarios:\nbRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3521 \n\nNote:\nAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:15:26.421Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-86146",
    "datePublished": "2026-10-21T12:15:26.421Z",
    "dateReserved": "2026-09-05T07:10:31.972Z",
    "dateUpdated": "2026-10-30T14:40:59.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-86146",
      "date": "2026-11-05",
      "epss": "0.0055",
      "percentile": "0.46195"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://github.com",
                "defaultStatus": "unaffected",
                "packageName": "apache/brpc",
                "packageURL": "pkg:github/apache/brpc",
                "product": "Apache bRPC",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "1.18.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version \u003c 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\n\nRoot Cause:\nThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\n1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC\u0027s framing while the reported field name contains the trailing space.\n2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\n3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC\u0027s framing while a front-end that does not unfold sees a different message.\n4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it.\n5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\n\nAffected Scenarios:\nbRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3521 \n\nNote:\nAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected."
          },
          {
            "lang": "es",
            "value": "Interpretaci\u00f3n inconsistente de solicitudes HTTP (smuggling de solicitudes/respuestas HTTP) en el analizador HTTP/1.1 incluido de Apache bRPC (versiones anteriores a 1.18.0) en todas las plataformas permite a atacantes remotos introducir solicitudes y inyectar encabezados cuando bRPC se despliega detr\u00e1s de un proxy o balanceador de carga que interpreta los mismos bytes de forma diferente.\\n\\nCausa ra\u00edz:\\nEl fork bRPC de http-parser acepta y act\u00faa sobre varias formas de encabezados HTTP/1.1 que un front?end conforme rechaza o interpreta de manera distinta, de modo que el encuadre o el conjunto de encabezados de un mensaje pueden diferir entre el front?end y bRPC:\\n1. Se acepta un espacio antes de los dos puntos de los encabezados de encuadre (p. ej., Content?Length : 5); el valor sigue determinando el encuadre de bRPC mientras que el nombre del campo reportado contiene el espacio final.\\n2. Los espacios internos dentro del valor de Content?Length (p. ej., Content?Length: 1 3) se omiten, de modo que bRPC lee 13 donde un front?end lee 1 o rechaza el mensaje (misma clase que CVE?2022?32213 en Node.js).\\n3. Se acepta el plegado de l\u00ednea obsoleto (obs?fold, RFC 7230 3.2.4) de los valores de Content?Length y Transfer?Encoding, de modo que un valor de encuadre plegado determina el encuadre de bRPC mientras que un front?end que no lo despliega ve un mensaje diferente.\\n4. Los campos de remolque chunked se env\u00edan a los mismos callbacks de encabezado que la secci\u00f3n de encabezados y se fusionan en el mapa de encabezados como encabezados reales. Un front?end solo inspecciona la secci\u00f3n de encabezados, por lo que cualquier solicitud chunked puede introducir campos como Autorizaci\u00f3n o X?Forwarded?For.\\n5. Las listas de Transfer?Encoding con espacio opcional despu\u00e9s de una coma (p. ej., Transfer?Encoding: gzip, chunked) no se reconocen como chunked: esas solicitudes son rechazadas y las respuestas se leen hasta el cierre de la conexi\u00f3n en lugar de como chunked, lo que provoca una desincronizaci\u00f3n de la respuesta.\\n\\nEscenarios afectados:\\nServidor o cliente bRPC que se comunican mediante HTTP/1.1 con un proxy frontal, balanceador de carga o cualquier par que analice el mensaje de forma independiente. Un atacante que pueda enviar solicitudes a trav\u00e9s del front?end puede desincronizar los dos analizadores para introducir solicitudes, falsificar encabezados (p. ej., Autorizaci\u00f3n, X?Forwarded?For) mediante remolques chunked, o desincronizar respuestas.\\n\\nC\u00f3mo solucionar:\\n1. Actualice bRPC a la versi\u00f3n 1.18.0, que corrige este problema.\\n2. Aplique este parche: https://github.com/apache/brpc/pull/3521\\n\\nNota:\\nDespu\u00e9s de aplicar la correcci\u00f3n, las cuatro formas de encabezado descritas anteriormente se rechazan por defecto y los remolques chunked se descartan en lugar de fusionarse en el mapa de encabezados. Se proporcionan dos gflags para compatibilidad: http_allow_obs_fold=true restaura la aceptaci\u00f3n de valores plegados de Content?Length/Transfer?Encoding, y http_strict_header_token=true rechaza adicionalmente los espacios dentro de cualquier nombre de campo de encabezado (no solo los que determinan el encuadre). Los clientes leg\u00edtimos que no utilizan estas formas obsoletas no se ven afectados."
          }
        ],
        "id": "CVE-2026-86146",
        "lastModified": "2026-10-30T15:16:56.480",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-86146",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T14:40:46.501949Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-21T13:20:04.137",
        "references": [
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-444"
              }
            ],
            "source": "security@apache.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.5,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-86146",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-30T14:40:46.501949Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-30T14:40:41.303Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com",
              "defaultStatus": "unaffected",
              "packageName": "apache/brpc",
              "packageURL": "pkg:github/apache/brpc",
              "product": "Apache bRPC",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThan": "1.18.0",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Claude"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version \u0026lt; 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\u003cbr\u003e\u003cbr\u003eRoot Cause:\u003cbr\u003eThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\u003cbr\u003e1. A space before the colon of framing headers (e.g. \u003ccode\u003eContent-Length : 5\u003c/code\u003e) is accepted; the value still drives bRPC\u0027s framing while the reported field name contains the trailing space.\u003cbr\u003e2. Interior spaces inside a \u003ccode\u003eContent-Length\u003c/code\u003e value (e.g. \u003ccode\u003eContent-Length: 1 3\u003c/code\u003e) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\u003cbr\u003e3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of \u003ccode\u003eContent-Length\u003c/code\u003e and \u003ccode\u003eTransfer-Encoding\u003c/code\u003e values is accepted, so a folded framing value drives bRPC\u0027s framing while a front-end that does not unfold sees a different message.\u003cbr\u003e4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as \u003ccode\u003eAuthorization\u003c/code\u003e or \u003ccode\u003eX-Forwarded-For\u003c/code\u003e past it.\u003cbr\u003e5. \u003ccode\u003eTransfer-Encoding\u003c/code\u003e lists with optional whitespace after a comma (e.g. \u003ccode\u003eTransfer-Encoding: gzip, chunked\u003c/code\u003e) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\u003cbr\u003e\u003cbr\u003eAffected Scenarios:\u003cbr\u003ebRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. \u003ccode\u003eAuthorization\u003c/code\u003e, \u003ccode\u003eX-Forwarded-For\u003c/code\u003e) via chunked trailers, or desynchronize responses.\u003cbr\u003e\u003cbr\u003eHow to Fix:\u003cbr\u003e(Choose one of the following options)\u003cbr\u003e1. Upgrade bRPC to version 1.18.0, which fixes this issue.\u003cbr\u003e2. Apply this patch: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3521\"\u003ehttps://github.com/apache/brpc/pull/3521\u003c/a\u003e\u003cbr\u003e\u003cbr\u003eNote:\u003cbr\u003eAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: \u003ccode\u003ehttp_allow_obs_fold=true\u003c/code\u003e restores acceptance of folded \u003ccode\u003eContent-Length\u003c/code\u003e/\u003ccode\u003eTransfer-Encoding\u003c/code\u003e values, and \u003ccode\u003ehttp_strict_header_token=true\u003c/code\u003e additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected."
                }
              ],
              "value": "Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version \u003c 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\n\nRoot Cause:\nThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\n1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC\u0027s framing while the reported field name contains the trailing space.\n2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\n3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC\u0027s framing while a front-end that does not unfold sees a different message.\n4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it.\n5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\n\nAffected Scenarios:\nbRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3521 \n\nNote:\nAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "text": "moderate"
                },
                "type": "Textual description of severity"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-444",
                  "description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-21T12:15:26.421Z",
            "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            "shortName": "apache"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
            }
          ],
          "source": {
            "discovery": "INTERNAL"
          },
          "title": "Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "assignerShortName": "apache",
        "cveId": "CVE-2026-86146",
        "datePublished": "2026-10-21T12:15:26.421Z",
        "dateReserved": "2026-09-05T07:10:31.972Z",
        "dateUpdated": "2026-10-30T14:40:59.777Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-86146

Vulnerability from fkie_nvd - Published: 2026-10-21 13:20 - Updated: 2026-10-30 15:16

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "product": "Apache bRPC",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version \u003c 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\n\nRoot Cause:\nThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\n1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC\u0027s framing while the reported field name contains the trailing space.\n2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\n3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC\u0027s framing while a front-end that does not unfold sees a different message.\n4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it.\n5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\n\nAffected Scenarios:\nbRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3521 \n\nNote:\nAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected."
    },
    {
      "lang": "es",
      "value": "Interpretaci\u00f3n inconsistente de solicitudes HTTP (smuggling de solicitudes/respuestas HTTP) en el analizador HTTP/1.1 incluido de Apache bRPC (versiones anteriores a 1.18.0) en todas las plataformas permite a atacantes remotos introducir solicitudes y inyectar encabezados cuando bRPC se despliega detr\u00e1s de un proxy o balanceador de carga que interpreta los mismos bytes de forma diferente.\\n\\nCausa ra\u00edz:\\nEl fork bRPC de http-parser acepta y act\u00faa sobre varias formas de encabezados HTTP/1.1 que un front?end conforme rechaza o interpreta de manera distinta, de modo que el encuadre o el conjunto de encabezados de un mensaje pueden diferir entre el front?end y bRPC:\\n1. Se acepta un espacio antes de los dos puntos de los encabezados de encuadre (p. ej., Content?Length : 5); el valor sigue determinando el encuadre de bRPC mientras que el nombre del campo reportado contiene el espacio final.\\n2. Los espacios internos dentro del valor de Content?Length (p. ej., Content?Length: 1 3) se omiten, de modo que bRPC lee 13 donde un front?end lee 1 o rechaza el mensaje (misma clase que CVE?2022?32213 en Node.js).\\n3. Se acepta el plegado de l\u00ednea obsoleto (obs?fold, RFC 7230 3.2.4) de los valores de Content?Length y Transfer?Encoding, de modo que un valor de encuadre plegado determina el encuadre de bRPC mientras que un front?end que no lo despliega ve un mensaje diferente.\\n4. Los campos de remolque chunked se env\u00edan a los mismos callbacks de encabezado que la secci\u00f3n de encabezados y se fusionan en el mapa de encabezados como encabezados reales. Un front?end solo inspecciona la secci\u00f3n de encabezados, por lo que cualquier solicitud chunked puede introducir campos como Autorizaci\u00f3n o X?Forwarded?For.\\n5. Las listas de Transfer?Encoding con espacio opcional despu\u00e9s de una coma (p. ej., Transfer?Encoding: gzip, chunked) no se reconocen como chunked: esas solicitudes son rechazadas y las respuestas se leen hasta el cierre de la conexi\u00f3n en lugar de como chunked, lo que provoca una desincronizaci\u00f3n de la respuesta.\\n\\nEscenarios afectados:\\nServidor o cliente bRPC que se comunican mediante HTTP/1.1 con un proxy frontal, balanceador de carga o cualquier par que analice el mensaje de forma independiente. Un atacante que pueda enviar solicitudes a trav\u00e9s del front?end puede desincronizar los dos analizadores para introducir solicitudes, falsificar encabezados (p. ej., Autorizaci\u00f3n, X?Forwarded?For) mediante remolques chunked, o desincronizar respuestas.\\n\\nC\u00f3mo solucionar:\\n1. Actualice bRPC a la versi\u00f3n 1.18.0, que corrige este problema.\\n2. Aplique este parche: https://github.com/apache/brpc/pull/3521\\n\\nNota:\\nDespu\u00e9s de aplicar la correcci\u00f3n, las cuatro formas de encabezado descritas anteriormente se rechazan por defecto y los remolques chunked se descartan en lugar de fusionarse en el mapa de encabezados. Se proporcionan dos gflags para compatibilidad: http_allow_obs_fold=true restaura la aceptaci\u00f3n de valores plegados de Content?Length/Transfer?Encoding, y http_strict_header_token=true rechaza adicionalmente los espacios dentro de cualquier nombre de campo de encabezado (no solo los que determinan el encuadre). Los clientes leg\u00edtimos que no utilizan estas formas obsoletas no se ven afectados."
    }
  ],
  "id": "CVE-2026-86146",
  "lastModified": "2026-10-30T15:16:56.480",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-86146",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-30T14:40:46.501949Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-21T13:20:04.137",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-QGCC-7CGJ-HMR3

Vulnerability from github – Published: 2026-10-21 15:42 – Updated: 2026-10-30 15:34

Details

Root Cause: The bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC: 1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC's framing while the reported field name contains the trailing space. 2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js). 3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC's framing while a front-end that does not unfold sees a different message. 4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it. 5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.

Affected Scenarios: bRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.

How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3521

Note: After applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-86146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-21T13:20:04Z",
    "severity": "HIGH"
  },
  "details": "Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version \u003c 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\n\nRoot Cause:\nThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\n1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC\u0027s framing while the reported field name contains the trailing space.\n2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\n3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC\u0027s framing while a front-end that does not unfold sees a different message.\n4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it.\n5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\n\nAffected Scenarios:\nbRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3521 \n\nNote:\nAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected.",
  "id": "GHSA-qgcc-7cgj-hmr3",
  "modified": "2026-10-30T15:34:11Z",
  "published": "2026-10-21T15:42:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86146"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-86146 (GCVE-0-2026-86146)

FKIE_CVE-2026-86146

GHSA-QGCC-7CGJ-HMR3

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour