CVE-2026-82425: CWE-617 Reachable Assertion in Apache Software Foundation Apache bRPC

This vulnerability in Apache bRPC (versions < 1.18.0) involves a reachable assertion triggered by a race condition between socket closure and health check revival. Specifically, when a socket with health checking enabled fails, its file descriptor is closed while the event dispatcher may still deliver input events for the closed descriptor. If the health check then revives the socket, the socket becomes addressable but has no valid file descriptor, causing an assertion failure (CHECK) in Socket::OnInputEvent. This assertion failure terminates the process, resulting in denial of service. A malicious remote peer can deliberately abort connections and immediately accept health check probes to trigger this condition. The issue is resolved in Apache bRPC 1.18.0, where stale input events on revived sockets without a file descriptor are silently dropped instead of triggering an assertion.

A remote malicious peer can cause the Apache bRPC client process to crash by exploiting the reachable assertion, leading to denial of service. This affects any application using bRPC clients with health check enabled and connected to a malicious or compromised server that races connection teardown against health check revival.

Upgrade Apache bRPC to version 1.18.0, which contains the official fix for this vulnerability. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3510. After the fix, stale input events on revived sockets without a file descriptor are dropped silently, preventing the assertion failure. No other user-visible changes or protocol modifications are required.