CVE-2026-82210: CWE-617 Reachable Assertion in Apache Software Foundation Apache bRPC

Apache bRPC versions before 1.18.0 contain an enforceable assertion vulnerability (CWE-617) in the streaming feature. Specifically, when processing FRAME_TYPE_FEEDBACK frames, the function Stream::SetRemoteConsumed() performs assertions on buffer sizes and payload emptiness. Malformed feedback frames or frames received on streams with flow control disabled trigger these assertions, causing the server process to abort. This allows an unauthenticated remote attacker, once a stream is established, to crash the server and cause denial of service. The issue is fixed in version 1.18.0 by rejecting malformed frames with an EPROTO error and closing only the affected stream, preventing the entire process from crashing.

An unauthenticated remote attacker can send a malformed stream feedback frame to an affected Apache bRPC server using the streaming control feature, causing the server process to abort and resulting in a denial of service. This disrupts availability but does not provide code execution or data breach capabilities based on the provided information.

Upgrade Apache bRPC to version 1.18.0 or later, which includes the official fix for this vulnerability. The fix rejects malformed feedback frames and closes only the affected stream instead of crashing the entire server process. Applying the patch from https://github.com/apache/brpc/pull/3494 also addresses the issue. No other mitigation is required as the fix prevents the assertion failure and denial of service.