Description
Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.

Root Cause:
When handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service.

Affected Scenarios:
Use bRPC server with the streaming control feature (Stream API) served from untrusted network.

How to Fix:
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3494

The fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an assert in the streaming layer of Apache bRPC that causes the server process to terminate when it receives a malformed FEEDBACK frame. The assertion failure occurs when a frame with unexpected payload or the frame is received on a stream where flow‑control is disabled. Resulting CHECK failures abort the server, giving an unauthenticated attacker the ability to crash the service after establishing any stream. The weakness is a type of assertion or invariant violation, mapped to CWE‑617.

Affected Systems

Apache Software Foundation’s bRPC component, versions earlier than 1.18.0, across all supported operating systems. The issue is present on any platform running the streaming API and can be triggered by clients that reach a bRPC server from an untrusted network.

Risk and Exploitability

EPSS indicates a very low exploitation probability (< 1 %), while the CVSS score of 7.5 reflects moderate‑to‑high severity. The denial‑of‑service impact is straightforward to trigger once a stream is established, but the low EPSS suggests that attacks may remain relatively rare. The vulnerability is not listed in CISA KEV. A remote attacker can connect to the bRPC server, establish a stream, then send a malformed FEEDBACK frame; because the frame input is unauthenticated, this can cause the server to crash. The public disclosure increases the visibility of the issue, but the low EPSS indicates that exploitation is still considered unlikely at the current time.

Generated by OpenCVE AI on October 30, 2026 at 17:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0, which removes the vulnerable assertion and correctly rejects malformed frames.
  • If an upgrade is not immediately possible, apply the community patch from PR 3494 to reject malformed frames and prevent the process from aborting.
  • Restrict access to the bRPC server so only trusted networks can initiate streams, or disable the streaming control feature entirely on servers exposed to untrusted traffic.

Generated by OpenCVE AI on October 30, 2026 at 17:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame. Root Cause: When handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service. Affected Scenarios: Use bRPC server with the streaming control feature (Stream API) served from untrusted network. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3494 The fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.
Title Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
Weaknesses CWE-617
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-30T14:25:54.253Z

Reserved: 2026-08-28T08:27:23.061Z

Link: CVE-2026-82210

cve-icon Vulnrichment

Updated: 2026-10-30T14:25:07.531Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T13:20:02.837

Modified: 2026-10-30T15:16:55.473

Link: CVE-2026-82210

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T17:45:15Z

Weaknesses