CVE-2026-82231: Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
A Thrift client in Apache bRPC (version < 1.18.0, built with WITHTHRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a TEXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::lengtherror). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC.
This is the client response path, so the adversary is the server peer, which THREATMODEL.md treats as untrusted. It requires a WITHTHRIFT build (off by default).
How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3500
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Only Apache bRPC clients built with WITH_THRIFT are affected; this build option is off by default. The affected client must communicate with a server peer that can return Thrift responses.
What does an attacker need to do to trigger the crash?
The attacker needs to control, impersonate, or otherwise cause a server peer to send a malformed T_EXCEPTION reply to the Thrift client. Apache bRPC's threat model treats the server peer in this response path as untrusted.
What is the operational impact of successful exploitation?
An uncaught Thrift decoding exception escapes a bthread task and causes std::terminate() to terminate the entire client process. This also ends all other in-flight RPCs in that process.
What can be done if an immediate upgrade is not possible?
Apply the referenced patch. As a temporary exposure reduction, avoid using Thrift-enabled bRPC clients with untrusted server peers where feasible.
How can I determine whether a build is affected?
Check whether the deployed bRPC version is earlier than 1.18.0 and whether it was built with WITH_THRIFT enabled. Builds without WITH_THRIFT are not affected.