Description
A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime.

Root Cause:
When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact).

Affected Scenarios:
Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3505
Published: 2026-10-21
Score: n/a
EPSS: n/a
KEV: No
Impact: Remote Denial of Service
Action: Patch
AI Analysis

Impact

A data race exists in the RDMA transport of Apache bRPC versions earlier than 1.18.0. When a client completes the RDMA handshake, the server mixes the TCP and RDMA input streams on the same socket buffer without proper synchronization. A remote, unauthenticated client can send data concurrently, corrupting the shared buffer and causing the server to crash. This results in a denial of service that affects only the specific bRPC process and can be triggered with an unauthenticated connection; the vulnerability is classified under CWE-362.

Affected Systems

This flaw affects Apache Software Foundation’s Apache bRPC when it is built with RDMA support enabled (BRPC_WITH_RDMA) and serves rdma:// or SOCKET_MODE_RDMA sockets. All deployments running versions prior to 1.18.0 that accept connections from untrusted clients are vulnerable. Deployments that do not enable RDMA or run newer releases are not impacted.

Risk and Exploitability

The vulnerability can be exploited remotely over a network connection that negotiates RDMA. The necessary preconditions are a server with RDMA enabled and the ability for an attacker to complete the RDMA handshake. The exploit does not require authentication and will result in an immediate crash of the bRPC service, interrupting availability. No EPSS score is available and the issue is not listed in the CISA KEV catalog, but the lack of authentication and the ease of triggering a crash indicate that the impact may be significant for environments that rely on uninterrupted RDMA services.

Generated by OpenCVE AI on October 21, 2026 at 18:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0 or later, which includes the fix for the race condition.
  • If an upgrade is not possible, apply the patch from https://github.com/apache/brpc/pull/3505 to address the shared buffer synchronization issue.
  • Disable RDMA support in the bRPC build or runtime configuration (remove BRPC_WITH_RDMA flag or avoid serving rdma:// sockets) to eliminate the attack surface.

Generated by OpenCVE AI on October 21, 2026 at 18:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact). Affected Scenarios: Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3505
Title Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
Weaknesses CWE-362
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-21T12:07:15.689Z

Reserved: 2026-08-31T12:23:58.368Z

Link: CVE-2026-82942

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T13:20:03.403

Modified: 2026-10-21T13:20:03.403

Link: CVE-2026-82942

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T18:30:14Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')