A race condition vulnerability (CWE-362) exists in Apache bRPC versions prior to 1.18.0 when RDMA support is enabled. This flaw allows a remote unauthenticated client to cause a denial of service by crashing the server process due to improper synchronization of shared input buffers during RDMA handshake and message processing. The issue occurs only if the server is built and run with RDMA enabled and accepts connections from untrusted clients. Upgrading to version 1.18.0 or applying the provided patch mitigates the vulnerability.
A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in denial of service.
Root Cause:
When a Socket with health checking enabled fails, Socket::WaitAndReset closes its file descriptor while the event dispatcher may still be delivering an input event (EPOLLIN/EVFILT_READ) that was fetched for the just-closed fd. If the health check then succeeds and revives the Socket, Socket::Address succeeds again while the fd is still -1 (the next write reconnects on demand). In that window, Socket::OnInputEvent hits CHECK(!(events & EPOLLIN)) (or the kqueue equivalent) because the Socket is addressable but has no fd. CHECK failures terminate the process when bRPC is built with glog or when the gflag -crash_on_fatal_log is enabled (CHECK always terminates in OFFICIAL_BUILD/NDEBUG builds as well).
Affected Scenarios:
Applications using bRPC clients with health check enabled (-health_check_interval). A malicious remote peer that the client connects to can deliberately abort connections and immediately accept the health check probes, racing connection teardown against health check revival to trigger the assertion and abort the process.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3510
Note:
After applying the fix, stale input events on a Socket revived without an fd are silently dropped instead of triggering the assertion. No user-visible interface or wire protocol is changed.
A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::length_error). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC.
This is the client response path, so the adversary is the server peer, which THREAT_MODEL.md treats as untrusted. It requires a WITH_THRIFT build (off by default).
How to Fix:
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3500
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.
Root Cause:
The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.
Affected Scenarios:
Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3499
Note:
No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.
Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.
Root Cause:
When handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service.
Affected Scenarios:
Use bRPC server with the streaming control feature (Stream API) served from untrusted network.
How to Fix:
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3494
The fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.
CVE-2026-81755 is an uncontrolled resource consumption vulnerability in Apache bRPC versions prior to 1.18.0. It affects the streaming RPC component, where a remote attacker can send a single RPC request declaring an excessive number of streams. This causes the server to allocate excessive memory and resources, leading to denial of service. The vulnerability arises because the server does not limit the number of streams accepted per request. The issue is fixed in version 1.18.0 by introducing a configurable limit on streams per request.
Apache bRPC versions prior to 1.18.0 contain a vulnerability where unbounded memory accumulation occurs in the stream message reassembly process. Remote attackers can exploit this by sending an endless sequence of continuation data frames, causing the server to exhaust memory and potentially crash or become unavailable. The issue arises because fragmented stream messages accumulate continuation frames without limits, and default flow-control settings do not throttle the sending rate. The vulnerability affects services accepting streams from untrusted clients using the built-in streaming protocol. The issue is fixed in version 1.18.0 by limiting the accumulated payload to max_body_size (default 64MB), closing streams that exceed this limit with an error. Adjusting max_body_size is possible to accommodate legitimate large messages.
CVE-2026-79704 is an out-of-bounds read vulnerability in Apache bRPC's streaming RPC client versions 1.11.0 through 1.17.0. The flaw occurs when a client creates multiple streams in a single RPC and the server response contains fewer extra_stream_ids than expected. This mismatch leads to an out-of-bounds read, potentially causing client crashes (denial of service) or unintended memory disclosure. The issue affects clients connecting to untrusted or malicious servers or networks. The vulnerability is fixed in version 1.18.0, which rejects malformed responses.
Apache bRPC versions prior to 1.18.0 have a missing authentication vulnerability in the streaming RPC path. This flaw allows remote attackers to bypass server authentication and inject or deliver streaming frames when the server is configured with an Authenticator. The issue arises because streaming RPC frames bypass the authentication hook, enabling unauthenticated peers to exchange frames. The vulnerability affects servers configured with authentication that serve streaming RPC from untrusted networks or where foreign connections can impersonate streams by ID. The issue is fixed in version 1.18.0.
CVE-2026-78066 is a resource exhaustion vulnerability in Apache bRPC versions prior to 1.18.0. Multiple parsers accept wire-controlled input without limiting declared sizes or decompressed output, allowing attackers to cause excessive memory consumption and crash the service. The issue affects gzip/zlib/snappy decompressors, AMF string readers, RTMP chunk headers, sofa-pbrpc parser, and mcpack2pb message handling. The vulnerability is fixed in version 1.18.0, which enforces limits on decompressed sizes and message lengths.
CVE-2026-78058 is an uncontrolled resource consumption vulnerability in Apache bRPC versions prior to 1.18.0 affecting the HTTP/2 receive path. It allows remote unauthenticated attackers to crash the server or cause unbounded memory growth by sending crafted HTTP/2 frames. The issue arises because the server does not enforce advertised HTTP/2 receive-side limits, leading to excessive resource use.
CVE-2026-78048 is a reachable-assertion vulnerability in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC versions before 1.18.0. This flaw allows a remote attacker to crash the server by sending a crafted sequence of HPACK headers, causing a denial of service. The issue arises from incorrect sizing of the dynamic-table ring buffer, which leads to an assertion failure during header processing. The vulnerability affects bRPC servers handling HTTP/2 or gRPC requests from untrusted networks. A fix is available in version 1.18.0 or via a specific patch.
CVE-2026-74758 is a heap use-after-free vulnerability in the RTMP protocol component of Apache bRPC versions prior to 1.18.0. It allows a remote attacker to crash a bRPC RTMP server by sending a specially crafted Abort control message without requiring authentication. The issue arises because the server deletes a chunk stream object while it is still being accessed, leading to use-after-free conditions.
CVE-2026-74757 is a resource allocation vulnerability in Apache bRPC versions prior to 1.18.0. The mcpack2pb component improperly trusts the item count in an mcpack array header without validating it against the actual payload size. This allows remote attackers to cause the server to allocate excessive memory by sending a crafted request with a very large array item count, potentially leading to process termination due to memory exhaustion.
An integer underflow vulnerability exists in Apache bRPC versions before 1.18.0 in the mcpack2pb component. This flaw allows remote attackers to crash a bRPC server by sending a specially crafted request with a string field having a zero value_size. The vulnerability arises because the UnparsedValue::as_string() function subtracts one from the value_size without validating it, causing an underflow and an uncaught exception that aborts the process. Default server configurations are typically not affected, but certain deployment patterns using nshead frames with the ubrpc mcpack2 adaptor are vulnerable.
Apache bRPC versions before 1.18.0 have a vulnerability where the client TLS peer verification validates the server certificate chain but does not verify that the certificate matches the expected DNS name or IP address. This allows a network attacker with a valid certificate for a different name to impersonate the intended TLS endpoint. The issue is fixed in version 1.18.0 by enabling proper hostname verification during the TLS handshake.
CVE-2026-61916 is an out-of-bounds read vulnerability in Apache bRPC before version 1.18.0 affecting platforms where plain char is unsigned, such as ARM64. The flaw arises from improper handling of high-bit bytes in URL parsing and case-insensitive header lookup, allowing remote attackers to cause a process crash and denial of service by sending crafted input. The issue does not affect builds where plain char is signed, such as x86_64. The vulnerability is fixed in Apache bRPC version 1.18.0 and later.
Apache bRPC versions before 1.18.0 have a vulnerability where the max_body_size limit is not consistently enforced during certain HTTP and response parsing operations. This allows a remote unauthenticated attacker to cause excessive memory consumption, potentially leading to denial of service. The issue is fixed in version 1.18.0, which properly rejects oversized HTTP bodies and responses.
CVE-2026-58064 is a vulnerability in Apache bRPC's Redis protocol implementation where inline command parsing allocates and copies the entire connection buffer before a complete CRLF-terminated command is received. This allows a remote attacker to send long inline inputs without a terminating CRLF, causing increased memory usage and CPU overhead, potentially leading to denial of service. The issue arises because the redis_max_allocation_size limit was not effectively applied to inline commands before allocation. The vulnerability affects Apache bRPC versions prior to 1.18.0. The issue is fixed in version 1.18.0 by applying the allocation limit to inline commands and rejecting lines exceeding this limit.
CVE-2026-56388 is an out-of-bounds write vulnerability in Apache bRPC's Redis server command parser. It occurs when the parser accepts an empty RESP array as a command header, allowing a remote unauthenticated attacker to cause a crash by sending a malformed command. The issue affects deployments with Redis service enabled that accept Redis protocol traffic from untrusted clients. The vulnerability is fixed in bRPC version 1.18.0.