Read the docs
TI-2026-78746 Aliases CVE-2026-82210GHSA-f22p-qq49-qcxh

Remote denial of service in Apache bRPC via malformed stream feedback frames

Priority LOW 39CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-617.

Summary

Apache bRPC before 1.18.0 contains a reachable assertion in its streaming feature on all platforms. A malformed stream feedback frame triggers a CHECK failure in Stream::SetRemoteConsumed(), which aborts the server process. An unauthenticated remote attacker who can establish a stream can crash the server and cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame. Root Cause: When handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service. Affected Scenarios: Use bRPC server with the streaming control feature (Stream API) served from untrusted network. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3494 The fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00498 42nd percentileScored 2026-11-07
Fix Fixed Apache bRPC (Apache Software Foundation): 1.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache bRPCbefore 1.18.01.18.0Patch availableCNA
  • Apache bRPC VendorApache Affected before 1.18.0 Fixed in 1.18.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*——Apache
  • cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:* Versions — — ·Apache

Remediation

Upgrade Apache bRPC to version 1.18.0, which fixes this issue. The same fix is also available as a patch in Apache bRPC pull request 3494.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Apache bRPC (Apache Software Foundation) Fixed in 1.18.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache bRPC — lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

    35 records Highest priority Priority MEDIUM 18 MEDIUM, 17 LOW

    Other records, highest priority first

    • TI-2026-78552 Out-of-bounds write in Apache bRPC Redis command parserPriority MEDIUM 49
    • TI-2026-78757 Authentication bypass in Apache bRPC servers using internal_portPriority MEDIUM 48
    • TI-2026-78742 Missing authentication in Apache bRPC streaming RPC framesPriority MEDIUM 48
    Show all 35 records → Advisory →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-82210
  2. 2026-10-21 Alias added: GHSA-f22p-qq49-qcxh
  3. 2026-10-30 CVSS score added · CISA ADP
  4. 2026-10-30 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences