CVE-2026-82231: CWE-248 Uncaught Exception in Apache Software Foundation Apache bRPC

In Apache bRPC versions before 1.18.0 built with WITH_THRIFT enabled (which is off by default), a malicious or faulty server peer can send a malformed T_EXCEPTION reply. When the client attempts to decode this reply, it throws exceptions (TProtocolException, TTransportException, or std::length_error) that are not caught within the bthread task function. This uncaught exception causes std::terminate() to be called, terminating the entire client process and all in-flight RPCs. The vulnerability is addressed by upgrading to bRPC version 1.18.0 or applying the patch linked in the vendor's repository.

The vulnerability allows a server peer to crash the client process by sending a malformed exception reply. This results in denial of service for the client, as the entire process terminates, disrupting all ongoing RPC communications. The threat model considers the server peer untrusted, so this can be exploited by a malicious server to disrupt client operations.

Upgrade Apache bRPC to version 1.18.0, which includes a fix for this vulnerability. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3500. Since the vulnerability requires a WITH_THRIFT build (off by default), ensure that this build option is disabled if not needed to reduce exposure.