https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 08:32:05 +0000 https://cve.radiocsirt.org/vuln/cve-2024-23452 <p><strong>Affected:</strong> Apache Software Foundation Apache bRPC</p> <p>Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request.</p> <p>Vulnerability Cause Description：</p> <p>The http_parser does not comply with the RFC-7230 HTTP 1.1 specification.</p> <p>Attack scenario: If a message is received with both a Transfer-Encoding and a Content-Length header field, such a message might indicate an attempt to perform request smuggling or response splitting. One particular attack scenario is that a bRPC made http server on the backend receiving requests in one persistent connection from frontend server that uses TE to parse request with the logic that &#39;chunk&#39; is contained in the TE field. in that case an attacker can smuggle a request into the connection to the backend server.</p> <p>Solution: You can choose one solution from below: 1. Upgrade bRPC to version 1.8.0, which fixes this issue. Download link: https://github.com/apache/brpc/releases/tag/1.8.0 2. Apply this patch:  https://github.com/apache/brpc/pull/2518</p> <p><strong>Affected:</strong> Apache Software Foundation Apache bRPC</p> <p>Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request.</p> <p>Vulnerability Cause Description：</p> <p>The http_parser does not comply with the RFC-7230 HTTP 1.1 specification.</p> <p>Attack scenario: If a message is received with both a Transfer-Encoding and a Content-Length header field, such a message might indicate an attempt to perform request smuggling or response splitting. One particular attack scenario is that a bRPC made http server on the backend receiving requests in one persistent connection from frontend server that uses TE to parse request with the logic that &#39;chunk&#39; is contained in the TE field. in that case an attacker can smuggle a request into the connection to the backend server.</p> <p>Solution: You can choose one solution from below: 1. Upgrade bRPC to version 1.8.0, which fixes this issue. Download link: https://github.com/apache/brpc/releases/tag/1.8.0 2. Apply this patch:  https://github.com/apache/brpc/pull/2518</p> https://cve.radiocsirt.org/vuln/cve-2024-23452