CVE-2026-82210

Deferred Deferred - Pending Action

Assertion Failure in Apache bRPC Streaming Feature

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame. Root Cause: When handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service. Affected Scenarios: Use bRPC server with the streaming control feature (Stream API) served from untrusted network. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3494 The fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-82210

EUVD

EUVD-2026-107216

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in Apache bRPC versions before 1.18.0. It occurs when a remote attacker sends a malformed stream feedback frame to a server using the streaming feature. The server process crashes due to failed assertions when handling these frames, terminating the entire server and disrupting service for all users.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in bRPC server processes handling streaming features. Check server logs for assertion failures or process aborts related to Stream::SetRemoteConsumed() or FRAME_TYPE_FEEDBACK frames. Use system monitoring tools to detect unexpected terminations of bRPC processes.

Impact Analysis

If you run a bRPC server with streaming enabled and allow untrusted network access, an attacker could crash your server by sending a single malformed feedback frame. This would cause a complete service outage, affecting all users and applications relying on the server.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt server availability. GDPR requires data processing systems to ensure availability and resilience, while HIPAA mandates safeguards against unauthorized disruptions. A crash due to this flaw may violate these requirements.

Mitigation Strategies

Immediately upgrade bRPC to version 1.18.0 or apply the patch from https://github.com/apache/brpc/pull/3494. Disable the streaming control feature if not required. Restrict network access to bRPC servers to trusted sources only.

Hi! I’m here to help you understand CVE-2026-82210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...