CVE-2026-82231

Deferred Deferred - Pending Action

Denial of Service in Apache bRPC Thrift Client

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::length_error). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC. This is the client response path, so the adversary is the server peer, which THREAT_MODEL.md treats as untrusted. It requires a WITH_THRIFT build (off by default). How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3500

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-82231

EUVD

EUVD-2026-107218

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects Apache bRPC clients built with WITH_THRIFT (disabled by default). A malicious server can crash the client by sending a malformed T_EXCEPTION reply. The client fails to handle exceptions properly, leading to process termination via std::terminate().

Detection Guidance

This vulnerability can be detected by checking the bRPC version in use. If the system is running a version older than 1.18.0 with WITH_THRIFT enabled, it is vulnerable. No specific commands are provided in the context to detect the vulnerability directly.

Impact Analysis

If exploited, this flaw can cause denial-of-service by crashing the bRPC client process. All in-flight RPCs are terminated, disrupting service availability. Only systems using WITH_THRIFT builds are affected.

Compliance Impact

This vulnerability causes a denial-of-service (DoS) condition by crashing the client process, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could interrupt critical healthcare operations. However, the specific compliance impact depends on system architecture and redundancy measures.

Mitigation Strategies

Upgrade bRPC to version 1.18.0 or later to fix the issue.
Apply the patch from https://github.com/apache/brpc/pull/3500 if upgrading is not immediately possible.
Ensure WITH_THRIFT is disabled if not required, as it is off by default and reduces exposure.

Hi! I’m here to help you understand CVE-2026-82231. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...