CVE-2026-82942: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Apache Software Foundation Apache bRPC
Description
A race condition vulnerability (CWE-362) exists in Apache bRPC versions prior to 1.18.0 when RDMA support is enabled. This flaw allows a remote unauthenticated client to cause a denial of service by crashing the server process due to improper synchronization of shared input buffers during RDMA handshake and message processing. The issue occurs only if the server is built and run with RDMA enabled and accepts connections from untrusted clients. Upgrading to version 1.18.0 or applying the provided patch mitigates the vulnerability.
Affected software
Apache Software Foundation
Apache bRPC
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache bRPC versions before 1.18.0 contain a data race in the RDMA transport implementation. When RDMA is enabled, the server's TCP file descriptor input stream and RDMA queue pair input stream share parsing buffers and state without proper synchronization. This allows concurrent processing of handshake and RDMA messages to corrupt shared buffers, leading to a server crash. The vulnerability affects deployments using RDMA-enabled bRPC servers that accept connections from untrusted clients. The issue is fixed in version 1.18.0 and a patch is available.
Potential Impact
A remote, unauthenticated client can exploit this race condition to crash the Apache bRPC server process, resulting in a denial of service. This impacts availability of the affected server. No other impacts such as code execution or data disclosure are described.
Mitigation Recommendations
Upgrade Apache bRPC to version 1.18.0, which contains an official fix for this vulnerability. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3505. Deployments not using RDMA support are not affected and require no action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-31T12:23:58.368Z
- State
- PUBLISHED
Threat ID: 6ad8b1502cdf04f656ecd9bf
Added to database: 10/21/2026, 12:34:24 UTC
Last enriched: 10/21/2026, 12:49:31 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.