Description
A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime.

Root Cause:
When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact).

Affected Scenarios:
Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3505
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Denial of Service
Action: Patch
AI Analysis

Impact

A data race exists in the RDMA transport of Apache bRPC versions earlier than 1.18.0. When a client completes the RDMA handshake, the server mixes the TCP and RDMA input streams on the same socket buffer without proper synchronization. A remote, unauthenticated client can send data concurrently, corrupting the shared buffer and causing the server to crash. This results in a denial of service that affects only the specific bRPC process and can be triggered with an unauthenticated connection; the vulnerability is classified under CWE-362.

Affected Systems

This flaw affects Apache Software Foundation’s Apache bRPC when it is built with RDMA support enabled (BRPC_WITH_RDMA) and serves rdma:// or SOCKET_MODE_RDMA sockets. All deployments running versions prior to 1.18.0 that accept connections from untrusted clients are vulnerable. Deployments that do not enable RDMA or run newer releases are not impacted.

Risk and Exploitability

The vulnerability can be exploited remotely over a network connection that negotiates RDMA. The necessary preconditions are a server with RDMA enabled and the ability for an attacker to complete the RDMA handshake. The exploit does not require authentication and will result in an immediate crash of the bRPC service, interrupting availability. The CVSS score is 7.5, indicating a medium severity, and the EPSS score is < 1%; the issue is not listed in the CISA KEV catalog, but the lack of authentication and the ease of triggering a crash indicate that the impact may be significant for environments that rely on uninterrupted RDMA services.

Generated by OpenCVE AI on October 30, 2026 at 16:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0 or later, which includes the fix for the race condition.
  • If an upgrade is not possible, apply the patch from https://github.com/apache/brpc/pull/3505 to address the shared buffer synchronization issue.
  • Disable RDMA support in the bRPC build or runtime configuration (remove BRPC_WITH_RDMA flag or avoid serving rdma:// sockets) to eliminate the attack surface.

Generated by OpenCVE AI on October 30, 2026 at 16:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact). Affected Scenarios: Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3505
Title Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
Weaknesses CWE-362
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-30T14:35:42.017Z

Reserved: 2026-08-31T12:23:58.368Z

Link: CVE-2026-82942

cve-icon Vulnrichment

Updated: 2026-10-30T14:35:27.208Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T13:20:03.403

Modified: 2026-10-30T15:16:55.963

Link: CVE-2026-82942

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T17:00:20Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')