Apache bRPC 1.18.0 fixes 35 flaws, including auth bypass

Apache released bRPC 1.18.0 to patch 35 vulnerabilities: 16 rated high and 19 moderate. They include an authentication bypass on HTTP endpoints (CVE-2026-48830), arbitrary file truncation via the /flags service and memory corruption in Redis, RTMP and HTTP/2 parsers. A ZoomEye scan found 5,197 internet-facing bRPC servers.

• 16 high and 19 moderate vulnerabilities fixed in bRPC 1.18.0
• CVE-2026-48830 bypasses auth on HTTP endpoints via keep-alive
• CVE-2026-86147 allows arbitrary file truncation via /flags service
• ZoomEye counted 5,197 internet-facing bRPC servers on 22 October 2026