A reachable assertion exists in Apache bRPC’s Socket::OnInputEvent routine, which can be triggered when health checking is enabled and a malicious remote peer aborts connections while the client’s health probe races a socket revival. When the race condition occurs, the assertion CHECK(!(events & EPOLLIN)) fails because the socket has no valid file descriptor, causing the process to terminate if the build includes glog or the gflag -crash_on_fatal_log is enabled. The result is a crash of the bRPC client process, leading to a denial of service of the application relying on that client.

Apache Software Foundation’s bRPC component is affected on all platforms for versions prior to 1.18.0. Any application that uses bRPC clients with the health_check_interval option enabled is potentially vulnerable.

Based on the description, it is inferred that a remote attacker who can reach a bRPC client with health checks enabled could trigger the race condition and cause the assertion to fail. The inferred attack vector is remote network access to the client; no authentication is required. The CVSS score of 7.5 indicates high severity, and the EPSS score of <1% points to a low but nonzero probability of exploitation. Because the assertion terminates the process when glog is built or the gflag –crash_on_fatal_log is enabled, the result is a denial of service for the application relying on that client.