CVE-2026-82942

Deferred Deferred - Pending Action

Race Condition in Apache bRPC RDMA Transport Leads to DoS

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact). Affected Scenarios: Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3505

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-82942

EUVD

EUVD-2026-107220

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

CVE-2026-82942 is a data race vulnerability in Apache bRPC's RDMA transport. When RDMA is enabled, a remote client can crash the server by sending data during the handshake or while RDMA messages are processed. The issue occurs because the TCP and RDMA input streams share the same buffer without synchronization, leading to buffer corruption and server crashes.

Detection Guidance

Check if your bRPC server is running with RDMA enabled by inspecting build flags and runtime configuration. Look for processes with BRPC_WITH_RDMA and sockets using rdma:// or SOCKET_MODE_RDMA. Monitor server logs for crashes or core dumps during RDMA operations.

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to crash the bRPC server process, causing a denial of service. Servers with RDMA enabled and configured to accept untrusted clients are affected. Systems without RDMA are not impacted.

Compliance Impact

This vulnerability primarily impacts system availability by causing server crashes through a data race condition. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, repeated crashes could lead to service disruptions, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade bRPC to version 1.18.0 or apply the patch from https://github.com/apache/brpc/pull/3505. If upgrading is not possible, disable RDMA support by rebuilding without BRPC_WITH_RDMA and avoid using rdma:// or SOCKET_MODE_RDMA sockets.

Hi! I’m here to help you understand CVE-2026-82942. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...