CVE-2026-82231: Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client

Q: Which deployments are exposed?

Only Apache bRPC clients built with WITH_THRIFT are affected; this build option is off by default. The affected client must communicate with a server peer that can return Thrift responses.

Q: What does an attacker need to do to trigger the crash?

The attacker needs to control, impersonate, or otherwise cause a server peer to send a malformed T_EXCEPTION reply to the Thrift client. Apache bRPC's threat model treats the server peer in this response path as untrusted.

Q: What is the operational impact of successful exploitation?

An uncaught Thrift decoding exception escapes a bthread task and causes std::terminate() to terminate the entire client process. This also ends all other in-flight RPCs in that process.

Q: What can be done if an immediate upgrade is not possible?

Apply the referenced patch. As a temporary exposure reduction, avoid using Thrift-enabled bRPC clients with untrusted server peers where feasible.

Q: How can I determine whether a build is affected?

Check whether the deployed bRPC version is earlier than 1.18.0 and whether it was built with WITH_THRIFT enabled. Builds without WITH_THRIFT are not affected.

Published Oct 21, 2026

Updated

A Thrift client in Apache bRPC (version < 1.18.0, built with WITHTHRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a TEXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::lengtherror). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC.

This is the client response path, so the adversary is the server peer, which THREATMODEL.md treats as untrusted. It requires a WITHTHRIFT build (off by default).

How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3500

Affected Software

1 affected component

Apache bRPC<1.18.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache bRPC to a version that resolves this vulnerability.
Fixed in 1.18.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:04 PM

Data Sourced

via MITRE·12:04 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Only Apache bRPC clients built with WITH_THRIFT are affected; this build option is off by default. The affected client must communicate with a server peer that can return Thrift responses.

What does an attacker need to do to trigger the crash?

The attacker needs to control, impersonate, or otherwise cause a server peer to send a malformed T_EXCEPTION reply to the Thrift client. Apache bRPC's threat model treats the server peer in this response path as untrusted.

What is the operational impact of successful exploitation?

An uncaught Thrift decoding exception escapes a bthread task and causes std::terminate() to terminate the entire client process. This also ends all other in-flight RPCs in that process.

What can be done if an immediate upgrade is not possible?

Apply the referenced patch. As a temporary exposure reduction, avoid using Thrift-enabled bRPC clients with untrusted server peers where feasible.

How can I determine whether a build is affected?

Check whether the deployed bRPC version is earlier than 1.18.0 and whether it was built with WITH_THRIFT enabled. Builds without WITH_THRIFT are not affected.

CVE-2026-82231: Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to trigger the crash?

What is the operational impact of successful exploitation?

What can be done if an immediate upgrade is not possible?

How can I determine whether a build is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to trigger the crash?

What is the operational impact of successful exploitation?

What can be done if an immediate upgrade is not possible?

How can I determine whether a build is affected?