CVE-2026-79704: CWE-125 Out-of-bounds Read in Apache Software Foundation Apache bRPC

Apache bRPC versions 1.11.0 through 1.17.0 contain an out-of-bounds read vulnerability in the streaming RPC client. When multiple streams are created in a single RPC, the client expects the server to return exactly one fewer extra_stream_id than the number of streams. The response handling code indexes these identifiers without validating the returned list size, allowing a malicious or compromised server to send fewer identifiers and trigger an out-of-bounds read. This can cause client process crashes or leak memory contents. The fix in version 1.18.0 enforces strict validation of the extra_stream_ids count, rejecting malformed responses and preventing the vulnerability.

A malicious or compromised server or an attacker on the network path can exploit this vulnerability by sending a malformed StreamSettings response with fewer extra_stream_ids than expected. This can cause the client process to crash, resulting in denial of service, or potentially leak unintended memory contents during stream handling. Surplus identifiers in responses with more extra_stream_ids than expected are processed inconsistently but do not cause out-of-bounds reads.

Upgrade Apache bRPC to version 1.18.0, which contains an official fix that rejects responses with mismatched extra_stream_ids counts, causing the RPC to fail cleanly. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3485. The fix prevents out-of-bounds reads by validating the size of the extra_stream_ids list before processing.