← Vulnerability feed

Vulnerability record · CVE-2024-23452 · published 8 February 2024

CVE-2024-23452: Apache brpc http request smuggling vulnerability

Apache · Brpc

Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description： The http_parser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a Transfer-Encoding and a Content-Length header field, such a message might indicate an attempt to perform request smuggling or response splitting. One particular attack scenario is that a bRPC made http server on the backend receiving requests in one persistent connection from frontend server that uses TE to parse request with the logic that 'chunk' is contained in the TE field. in that case an attacker can smuggle a request into the connection to the backend server.  Solution: You can choose one solution from below: 1. Upgrade bRPC to version 1.8.0, which fixes this issue. Download link: https://github.com/apache/brpc/releases/tag/1.8.0 2. Apply this patch:  https://github.com/apache/brpc/pull/2518

7.5 CVSS 3.1 High EPSS 1.6% · top 24.6% CWE-444 · HTTP request smuggling
7.5CVSS 3.1 base score
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description： The http_parser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a Transfer-Encoding and a Content-Length header field, such a message might indicate an attempt to perform request smuggling or response splitting. One particular attack scenario is that a bRPC made http server on the backend receiving requests in one persistent connection from frontend server that uses TE to parse request with the logic that 'chunk' is contained in the TE field. in that case an attacker can smuggle a request into the connection to the backend server.  Solution: You can choose one solution from below: 1. Upgrade bRPC to version 1.8.0, which fixes this issue. Download link: https://github.com/apache/brpc/releases/tag/1.8.0 2. Apply this patch:  https://github.com/apache/brpc/pull/2518

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.openwall.com/lists/oss-security/2024/02/08/1 Mailing ListThird Party Advisory
https://github.com/apache/brpc/pull/2518 Patch
https://github.com/apache/brpc/releases/tag/1.8.0 Release Notes
https://lists.apache.org/thread/kkvdpwyr2s2yt9qvvxfdzon012898vxd Issue TrackingVendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/08/1 Mailing ListThird Party Advisory
https://github.com/apache/brpc/pull/2518 Patch
https://github.com/apache/brpc/releases/tag/1.8.0 Release Notes
https://lists.apache.org/thread/kkvdpwyr2s2yt9qvvxfdzon012898vxd Issue TrackingVendor Advisory

Track CVE-2024-23452 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-60021Apache brpc command injection vulnerabilityRemote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to …EPSS 26%9.8CVE-2023-31039Apache brpc improper input validation vulnerabilitySecurity vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker tha…EPSS 1.5%7.5CVE-2025-59789Apache brpc vulnerabilityUncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote attackers to make the server crash v…EPSS 1.6%7.5CVE-2025-54472Apache brpc integer overflow vulnerabilityUnlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service vi…EPSS 1.3%6.1CVE-2023-45757Apache brpc cross-site scripting vulnerabilitySecurity vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can sen…EPSS 0.96%6.5CVE-2026-48710Starlette Host header validation flaw enables request.url path mismatchStarlette before 1.0.1 did not validate the HTTP Host header before using it to rebuild request.url, so a malformed Host value could make request.url…KEVEPSS 7.1%analysed7.5CVE-2025-61884Oracle E-Business Suite Configurator pre-auth data exposure flawOracle Configurator in Oracle E-Business Suite 12.2.3 through 12.2.14 exposes a vulnerability reachable over HTTP without authentication. A successfu…KEVEPSS 96%analysed9.9CVE-2023-48365Qlik Sense Enterprise HTTP Request Smuggling Enables Unauthenticated RCEQlik Sense Enterprise for Windows before August 2023 Patch 2 fails to properly validate HTTP headers, allowing HTTP request tunneling to the backend …KEVEPSS 47%analysed

Source: NIST National Vulnerability Database (record CVE-2024-23452), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.