Live › vulnerability › CVE-2026-82210
Go to dashboardApache bRPC versions before 1.18.0 hit failed CHECK assertions in the streaming feature when a feedback frame carries an unexpected payload or arrives on a stream without flow control. An attacker who can open a stream can make the server process abort.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers built on Apache bRPC that use the streaming control feature (Stream API) and accept traffic from untrusted networks. Services that do not use streaming, or that only run on trusted internal networks, are less exposed. The sources do not say which default configuration, if any, enables streaming.
No product ranges from the sources yet.
grep -r BRPC_VERSION in the build or unknown if not declared1.18.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.
Root Cause: When handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service.
Affected Scenarios: Use bRPC server with the streaming control feature (Stream API) served from untrusted network.
How to Fix:
The fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-82210")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.