CVE-2026-90484

Deferred Deferred - Pending Action

Null Pointer Dereference in Apache bRPC MySQL Client

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Apache Software Foundation

Description

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (is_full_package), after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, and type = p[4] dereferences it, crashing the client process. Root Cause: In brpc::policy::MysqlReply::ConsumePartialIOBuf, buf.fetch(header, 5) returns nullptr when the buffered data only holds the 4-byte header of a zero-length packet, then the code reads p[4] (and, in the fast-auth path, p2[4]) without checking for a null or zero-length packet. Affected Scenarios: A brpc MySQL client connecting to a malicious or compromised MySQL server (or a MITM) can be crashed by a zero-length server response packet, resulting in denial of service of the client. Fix: The fix rejects zero-length response packets (returning PARSE_ERROR_ABSOLUTELY_WRONG) both for the initial response type determination and after a fast-auth marker, before reading the type byte. Upgrade to the Apache bRPC version 1.18.0 or apply the PR patch at https://github.com/apache/brpc/pull/3536.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-26

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-90484

EUVD

EUVD-2026-107230

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	<= 1.11.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

The vulnerability is in Apache bRPC's MySQL client response parser. When a server sends a response packet with a declared payload length of zero, the parser incorrectly reads the response type byte without validating the packet's length. This causes a null pointer dereference, leading to a crash of the client process.

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using Apache bRPC MySQL clients. Check logs for null pointer dereference errors in brpc::policy::MysqlReply::ConsumePartialIOBuf. Inspect network traffic for zero-length MySQL response packets sent to bRPC clients.

Impact Analysis

This vulnerability can cause a denial of service for the bRPC MySQL client. If a client connects to a malicious or compromised MySQL server (or a man-in-the-middle attacker), it can be crashed by sending a zero-length response packet, disrupting services relying on the client.

Compliance Impact

This vulnerability primarily causes denial of service by crashing the brpc MySQL client process, which could disrupt data processing or availability. It does not directly impact data confidentiality or integrity, so its effect on GDPR or HIPAA compliance is likely minimal unless service disruption leads to compliance violations.

Mitigation Strategies

Upgrade to Apache bRPC version 1.18.0 or apply the patch from PR #3536 to reject zero-length MySQL response packets before parsing.

Hi! I’m here to help you understand CVE-2026-90484. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...