CVE-2026-90484: Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (isfullpackage), after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, and type = p[4] dereferences it, crashing the client process.
Root Cause: In brpc::policy::MysqlReply::ConsumePartialIOBuf, buf.fetch(header, 5) returns nullptr when the buffered data only holds the 4-byte header of a zero-length packet, then the code reads p[4] (and, in the fast-auth path, p2[4]) without checking for a null or zero-length packet.
Affected Scenarios: A brpc MySQL client connecting to a malicious or compromised MySQL server (or a MITM) can be crashed by a zero-length server response packet, resulting in denial of service of the client.
Fix: The fix rejects zero-length response packets (returning PARSEERRORABSOLUTELYWRONG) both for the initial response type determination and after a fast-auth marker, before reading the type byte. Upgrade to the Apache bRPC version 1.18.0 or apply the PR patch at https://github.com/apache/brpc/pull/3536.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Who can trigger the crash?
A malicious or compromised MySQL server can trigger it against a bRPC MySQL client. A man-in-the-middle attacker that can alter server responses can also do so.
What packet is required to exploit the issue?
The attacker must send a MySQL server response packet with a declared payload length of zero. The frame-length check accepts this packet, after which the client dereferences a null pointer while attempting to read its response type.
What should teams do if they cannot patch immediately?
The provided data identifies untrusted, compromised, or intercepted MySQL server connections as the exposure condition. Restrict bRPC clients to trusted MySQL endpoints and protect the connection from man-in-the-middle modification until the fix can be applied.
Which remediation is available?
Upgrade Apache bRPC to version 1.18.0 or apply the referenced PR patch. The fix rejects zero-length response packets before reading the response type, including in the fast-auth path.