Description
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (is_full_package), after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, and type = p[4] dereferences it, crashing the client process.



Root Cause: In brpc::policy::MysqlReply::ConsumePartialIOBuf, buf.fetch(header, 5) returns nullptr when the buffered data only holds the 4-byte header of a zero-length packet, then the code reads p[4] (and, in the fast-auth path, p2[4]) without checking for a null or zero-length packet.



Affected Scenarios: A brpc MySQL client connecting to a malicious or compromised MySQL server (or a MITM) can be crashed by a zero-length server response packet, resulting in denial of service of the client.



Fix: The fix rejects zero-length response packets (returning PARSE_ERROR_ABSOLUTELY_WRONG) both for the initial response type determination and after a fast-auth marker, before reading the type byte. Upgrade to the Apache bRPC version 1.18.0 or apply the PR patch at https://github.com/apache/brpc/pull/3536.
Published: 2026-10-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service due to client crash
Action: Patch
AI Analysis

Impact

The vulnerability is a null pointer dereference in the MySQL reply parser of Apache bRPC. When the server sends a packet whose declared payload length is zero, the parser fetches a 5-byte header. If only the 4-byte header is present, the fetch returns nullptr, and the code reads p[4] without checking for a null pointer. This leads to a client crash, effectively denying service to the application that depends on the bRPC library.

Affected Systems

The flaw resides in Apache bRPC, the open‑source RPC framework from the Apache Software Foundation. Any installation of Apache bRPC that uses the MySQL client stub and has not been upgraded beyond the patched 1.18.0 release remains vulnerable. The exact affected minor versions are not enumerated; developers are advised to ensure they run 1.18.0 or later, or apply the patch in pull request 3536.

Risk and Exploitability

The impact is a denial of service against the bRPC MySQL client; an attacker who can control the server or position a man‑in‑the‑middle between the client and the server can simply send a zero‑length packet to crash the process. The vulnerability is not listed in the CISA KEV catalog, and the EPSS score is < 1%, indicating a very low exploitation probability. The CVSS score is 6.5, reflecting a moderate severity. Administrators should treat it as a significant risk until the library is updated.

Generated by OpenCVE AI on October 26, 2026 at 15:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Apache bRPC library to version 1.18.0 or later to obtain the patch that rejects zero‑length response packets.
  • If an immediate upgrade is not feasible, apply the local patch from pull request 3536 to the existing source or binary.
  • Restrict network connectivity so that only trusted MySQL servers can communicate with the bRPC client, thereby reducing the attack surface from compromised or malicious servers.

Generated by OpenCVE AI on October 26, 2026 at 15:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (is_full_package), after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, and type = p[4] dereferences it, crashing the client process. Root Cause: In brpc::policy::MysqlReply::ConsumePartialIOBuf, buf.fetch(header, 5) returns nullptr when the buffered data only holds the 4-byte header of a zero-length packet, then the code reads p[4] (and, in the fast-auth path, p2[4]) without checking for a null or zero-length packet. Affected Scenarios: A brpc MySQL client connecting to a malicious or compromised MySQL server (or a MITM) can be crashed by a zero-length server response packet, resulting in denial of service of the client. Fix: The fix rejects zero-length response packets (returning PARSE_ERROR_ABSOLUTELY_WRONG) both for the initial response type determination and after a fast-auth marker, before reading the type byte. Upgrade to the Apache bRPC version 1.18.0 or apply the PR patch at https://github.com/apache/brpc/pull/3536.
Title Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
Weaknesses CWE-476
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-26T13:39:12.101Z

Reserved: 2026-09-12T04:06:06.138Z

Link: CVE-2026-90484

cve-icon Vulnrichment

Updated: 2026-10-26T13:39:02.921Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T13:20:56.590

Modified: 2026-10-26T21:10:00.170

Link: CVE-2026-90484

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T16:00:18Z

Weaknesses