A reachable assertion exists in Apache bRPC’s Socket::OnInputEvent routine, which can be triggered when health checking is enabled and a malicious remote peer aborts connections while the client’s health probe races a socket revival. When the race condition occurs, the assertion CHECK(!(events & EPOLLIN)) fails because the socket has no valid file descriptor, causing the process to terminate if the build includes glog or the gflag -crash_on_fatal_log is enabled. The result is a crash of the bRPC client process, leading to a denial of service of the application relying on that client.

Apache Software Foundation’s bRPC component is affected on all platforms for versions prior to 1.18.0. Any application that uses bRPC clients with the health_check_interval option enabled is potentially vulnerable.

The vulnerability is exploitable by any remote attacker who can reach a bRPC client with health checks enabled, as no authentication is required to trigger the race condition. While the contest does not provide an EPSS score or CVSS base, the nature of the flaw—a remote assertion crash—implies significant availability impact. The attack vector is inferred from the description, suggesting that the attacker needs network access to the client.