Description
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through  1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional stream. The response handling path indexed the returned identifiers using the locally created stream count without first validating the size of the returned list, so a malicious or compromised server (or an on-path attacker) can trigger an out-of-bounds read in the client by returning a malformed StreamSettings response with fewer extra_stream_ids than expected. This may crash the client process (denial of service) or leak unintended memory contents into subsequent stream handling; surplus identifiers have no valid client-stream mapping and are processed inconsistently.

Root Cause:
Since bRPC 1.11.0, a client can create multiple streams in one RPC via batch StreamCreate. The expected behavior is that the server response must return exactly (N-1) extra_stream_ids, where N is the number of locally created streams. In Controller::HandleStreamConnection, the response path reads extra_stream_ids[i-1] for each additional local stream without first comparing the returned list size with (N-1). If the server returns fewer identifiers, the read runs past the end of the returned list (out-of-bounds read); if it returns more, the surplus identifiers have no corresponding client-side stream.

Affected Scenarios:
A bRPC client using multi-stream RPC (creating more than one stream in a single RPC) that connects to an untrusted, malicious, or compromised server or to a server reached through an untrusted network path. The server sends a malformed StreamSettings response to trigger the issue.


How to Fix:
(Choose one of the following options) 
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3485


Note:
The fix makes the client reject responses whose extra_stream_ids count does not exactly match the number of additional client streams. Such mismatched responses now fail the RPC with ERESPONSE and go through the existing stream cleanup path, instead of being partially processed.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and potential memory disclosure.
Action: Immediate Patch
AI Analysis

Impact

An out‑of‑bounds read in the Apache bRPC client can be triggered when a server returns a malformed list of extra_stream_ids in a multi‑stream RPC response. The client indexes these identifiers without verifying the response size, leading to reads beyond the allocated array. The result may be a client crash or leakage of unintended memory contents into subsequent stream handling, potentially exposing sensitive data.

Affected Systems

The defect affects Apache bRPC versions 1.11.0 through 1.17.0 on all supported platforms. Clients that use multi‑stream RPC (creating more than one stream in a single RPC) are vulnerable when connected to untrusted or malicious servers or traversing an untrusted network path.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, but the EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation has not yet been observed. Nevertheless, a malicious or compromised server can trigger the vulnerability, causing denial of service or leaking memory to the attacker. Since the vector involves a trusted client communicating with an untrusted server, the attack can be launched in ordinary network environments. The likely attack vector is a malicious or compromised server or an attacker in transit.

Generated by OpenCVE AI on October 30, 2026 at 19:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade bRPC to version 1.18.0, which includes the fix.
  • If upgrade is not possible, apply the patch referenced by the Apache bRPC pull request 3485.
  • Schedule regular updates to ensure the bRPC library remains current and to deploy any future security fixes promptly.

Generated by OpenCVE AI on October 30, 2026 at 19:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through  1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional stream. The response handling path indexed the returned identifiers using the locally created stream count without first validating the size of the returned list, so a malicious or compromised server (or an on-path attacker) can trigger an out-of-bounds read in the client by returning a malformed StreamSettings response with fewer extra_stream_ids than expected. This may crash the client process (denial of service) or leak unintended memory contents into subsequent stream handling; surplus identifiers have no valid client-stream mapping and are processed inconsistently. Root Cause: Since bRPC 1.11.0, a client can create multiple streams in one RPC via batch StreamCreate. The expected behavior is that the server response must return exactly (N-1) extra_stream_ids, where N is the number of locally created streams. In Controller::HandleStreamConnection, the response path reads extra_stream_ids[i-1] for each additional local stream without first comparing the returned list size with (N-1). If the server returns fewer identifiers, the read runs past the end of the returned list (out-of-bounds read); if it returns more, the surplus identifiers have no corresponding client-side stream. Affected Scenarios: A bRPC client using multi-stream RPC (creating more than one stream in a single RPC) that connects to an untrusted, malicious, or compromised server or to a server reached through an untrusted network path. The server sends a malformed StreamSettings response to trigger the issue. How to Fix: (Choose one of the following options)  1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3485 Note: The fix makes the client reject responses whose extra_stream_ids count does not exactly match the number of additional client streams. Such mismatched responses now fail the RPC with ERESPONSE and go through the existing stream cleanup path, instead of being partially processed.
Title Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
Weaknesses CWE-125
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-30T17:03:38.510Z

Reserved: 2026-08-25T12:37:38.744Z

Link: CVE-2026-79704

cve-icon Vulnrichment

Updated: 2026-10-30T17:03:23.039Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T12:17:23.787

Modified: 2026-10-30T17:17:29.490

Link: CVE-2026-79704

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T19:45:14Z

Weaknesses