Cyber ·
Apache bRPC 1.18.0 fixes 35 vulnerabilities, 16 rated high
A notice on the oss-sec feed reports that Apache bRPC 1.18.0 fixes 35 vulnerabilities: 16 high and 19 moderate. One case, CVE-2026-48830, allows bypassing authentication in versions up to 1.17.0.
On October 20, 2026, the oss-sec feed published a notice that Apache bRPC 1.18.0 fixes 35 vulnerabilities, 16 rated high and 19 moderate. The item appeared on the feed on October 21, 2026 and reproduces an automatic translation of the original announcement, which should be checked against the source.
The first item listed is CVE-2026-48830: an internal HTTP request can mark a connection as authenticated and bypass authentication on later requests. The notice states that Apache bRPC versions up to 1.17.0 are affected and that 1.18.0 is not. The description text is truncated in the source, so the remaining details of the 35 items are not included here.
Relevance: Rota Nacional is not a component of bRPC and does not patch this library. Anyone using bRPC should check the version in use, upgrade to 1.18.0 or later, and consult the original announcement for the full list of CVEs and affected versions. When studying the notice with an AI assistant, do not paste configurations, credentials, tokens or log excerpts containing personal data; remove them before sending.
Original source: Aviso de segurança do Apache bRPC: 35 vulnerabilidades corrigidas na versão 1.18.0