CVE-2026-82210: Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.
Root Cause: When handling FRAMETYPEFEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(curbufsize > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (curbufsize == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service.
Affected Scenarios: Use bRPC server with the streaming control feature (Stream API) served from untrusted network.
How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3494
The fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so curbufsize never drops to 0 while flow control is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
bRPC servers using the streaming control feature (Stream API) that are reachable from an untrusted network are identified as affected. The issue applies to versions earlier than 1.18.0 on all platforms.
What does an attacker need to do to trigger the crash?
The attacker must establish a stream, then send a malformed FRAME_TYPE_FEEDBACK frame. This can be a feedback frame with an unexpected payload or one sent on a stream where flow control is disabled; no authentication is required.
Is there a mitigation if upgrading cannot happen immediately?
Apply the referenced patch. It rejects malformed feedback frames with EPROTO and closes the affected stream rather than aborting the server process.
How can I determine whether a server is vulnerable?
A server is vulnerable if it runs bRPC earlier than 1.18.0 and uses the Stream API in a context exposed to untrusted clients. Crash logs may show failed CHECK assertions in Stream::SetRemoteConsumed(), including checks for _cur_buf_size > 0 or an empty frame payload.