{"id":"CVE-2026-79704","kind":"vulnerability","aliases":["CVE-2026-79704"],"related":[],"title":"Apache bRPC: malformed stream response lets a server crash client or leak memory","description":"An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through  1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional stream. The response handling path indexed the returned identifiers using the locally created stream count without first validating the size of the returned list, so a malicious or compromised server (or an on-path attacker) can trigger an out-of-bounds read in the client by returning a malformed StreamSettings response with fewer extra_stream_ids than expected. This may crash the client process (denial of service) or leak unintended memory contents into subsequent stream handling; surplus identifiers have no valid client-stream mapping and are processed inconsistently.\n\nRoot Cause:\nSince bRPC 1.11.0, a client can create multiple streams in one RPC via batch StreamCreate. The expected behavior is that the server response must return exactly (N-1) extra_stream_ids, where N is the number of locally created streams. In Controller::HandleStreamConnection, the response path reads extra_stream_ids[i-1] for each additional local stream without first comparing the returned list size with (N-1). If the server returns fewer identifiers, the read runs past the end of the returned list (out-of-bounds read); if it returns more, the surplus identifiers have no corresponding client-side stream.\n\nAffected Scenarios:\nA bRPC client using multi-stream RPC (creating more than one stream in a single RPC) that connects to an untrusted, malicious, or compromised server or to a server reached through an untrusted network path. The server sends a malformed StreamSettings response to trigger the issue.\n\n\nHow to Fix: \n(Choose one of the following options) \n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3485 \n\n\nNote:\nThe fix makes the client reject responses whose extra_stream_ids count does not exactly match the number of additional client streams. Such mismatched responses now fail the RPC with ERESPONSE and go through the existing stream cleanup path, instead of being partially processed.","summary":"A bRPC client that creates several streams in one RPC reads past the end of the server's response list when the server returns too few stream identifiers. A malicious or compromised server, or an on-path attacker, can crash the client process or leak unintended memory into later stream handling.","severity":"medium","cvss":null,"epss":0.00164,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-brpc","bpc","c++","package","rpc","streaming"],"not_affected_if":["server-only","single-stream-rpc","trusted-network"],"how_to_check":"- Check the bRPC version in use, for example with `grep -r brpc` in the build files or `ldd` on the client binary, and see whether it falls in `1.11.0` through `1.17.0`.\n- Look for client code that issues a single RPC creating more than one stream (batch StreamCreate, bRPC 1.11.0 or later).","fix":"- Upgrade Apache bRPC to `1.18.0`.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3485.","status":"open","published_at":"2026-10-21T12:17:23+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:35+00:00","updated_at":"2026-10-25T05:02:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:02:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0`.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3485.","reach":"network","title":"Apache bRPC: malformed stream response lets a server crash client or leak memory","impact":"medium","summary":"A bRPC client that creates several streams in one RPC reads past the end of the server's response list when the server returns too few stream identifiers. A malicious or compromised server, or an on-path attacker, can crash the client process or leak unintended memory into later stream handling.","category":"package","nicknames":[],"who_cares":["bpc","c++","rpc","streaming","apache-brpc"],"confidence":0.8,"needs_auth":"no","worst_case":"Client process crashes, or unintended memory contents leak into stream handling","analyst_note":"","how_to_check":"- Check the bRPC version in use, for example with `grep -r brpc` in the build files or `ldd` on the client binary, and see whether it falls in `1.11.0` through `1.17.0`.\n- Look for client code that issues a single RPC creating more than one stream (batch StreamCreate, bRPC 1.11.0 or later).","needs_analyst":false,"not_affected_if":["single-stream-rpc","server-only","trusted-network"],"who_is_affected":"Only bRPC clients that use multi-stream RPC, creating more than one stream in a single call, are exposed. The danger comes from the server side of the connection, so clients that talk only to trusted servers over a trusted network are at lower risk, but a malicious server or an on-path attacker is enough to trigger it. Services that use bRPC only as a server or that never create multiple streams per RPC can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":3987,"output_tokens":623,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1':247C,271C,286C '-2026':15A,18A '-79704':16A,19A '/apache/brpc/pull/3485':396C '1':380C '1.11.0':97C,222C '1.17.0':99C '1.18.0':385C '2':390C 'addit':126C,274C,417C 'affect':322C 'apach':1A,21B,94C 'apache-brpc':20B 'appli':391C 'attack':66B,162C 'batch':233C 'behavior':237C 'bound':84C,169C,306C 'bpc':23B 'brpc':2A,22B,29B,95C,221C,325C,382C 'c':24B 'carri':118C 'caus':219C 'choos':374C 'cleanup':435C 'client':10A,30B,70B,92C,104C,173C,191C,211C,224C,319C,326C,402C,418C 'client-sid':318C 'client-stream':210C 'compar':279C 'compromis':59B,155C,348C 'connect':342C 'content':200C 'control':261C 'correspond':317C 'count':141C,409C 'crash':9A,68B,189C 'creat':32B,106C,139C,226C,258C,332C 'cve':14A,17A 'denial':193C 'end':41B,298C 'erespons':428C 'everi':125C 'exact':119C,245C,412C 'exist':87C,433C 'expect':113C,186C,236C 'extra':121C,182C,248C,267C,406C 'fail':424C 'fewer':181C,291C 'first':143C,278C 'fix':373C,387C,399C 'follow':378C 'github.com':395C 'github.com/apache/brpc/pull/3485':394C 'go':430C 'handl':79B,130C,204C 'handlestreamconnect':262C 'id':123C,184C,250C,269C,408C 'identifi':55B,135C,206C,292C,314C 'inconsist':217C 'index':132C 'instead':437C 'issu':370C,389C 'later':77B 'leak':12A,73B,197C 'let':6A 'list':47B,150C,282C,302C 'local':138C,257C,275C 'make':400C 'malform':3A,177C,364C 'malici':57B,153C,346C 'map':213C 'match':413C 'may':188C 'memori':13A,75B,199C 'mismatch':421C 'multi':329C 'multi-stream':328C 'multipl':107C,227C 'must':243C 'n':246C,252C,285C 'network':358C 'note':397C 'number':255C,415C 'on-path':63B,159C 'one':36B,120C,230C,335C,375C 'option':379C 'out-of-bound':81C,166C,303C 'packag':25B 'partial':440C 'past':39B,296C 'patch':393C 'path':65B,131C,161C,265C,359C,436C 'platform':102C 'process':71B,192C,216C,441C 'reach':354C 'read':38B,85C,170C,266C,294C,307C 'reject':403C 'respons':5A,46B,116C,129C,179C,242C,264C,366C,404C,422C 'return':51B,134C,149C,175C,244C,281C,290C,301C,310C 'root':218C 'rpc':26B,37B,91C,112C,231C,331C,340C,426C 'run':295C 'scenario':323C 'send':362C 'server':8A,44B,50B,60B,115C,156C,241C,289C,349C,353C,361C 'servic':195C 'sever':33B 'side':320C 'sinc':220C 'singl':111C,339C 'size':146C,283C 'stream':4A,27B,34B,54B,78B,90C,108C,122C,127C,140C,183C,203C,212C,228C,249C,259C,268C,276C,321C,330C,336C,407C,419C,434C 'streamcreat':234C 'streamset':178C,365C 'subsequ':202C 'surplus':205C,313C 'trigger':164C,368C 'unintend':74B,198C 'untrust':345C,357C 'upgrad':381C 'use':136C,327C 'valid':144C,209C 'version':96C,384C 'via':232C 'vulner':86C 'whose':405C 'without':142C,277C","nicknames":[],"mitigations":[],"who_affected":"Only bRPC clients that use multi-stream RPC, creating more than one stream in a single call, are exposed. The danger comes from the server side of the connection, so clients that talk only to trusted servers over a trusted network are at lower risk, but a malicious server or an on-path attacker is enough to trigger it. Services that use bRPC only as a server or that never create multiple streams per RPC can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79704","severity":null,"published_at":"2026-10-21T12:17:23+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79704","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79704","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}