{"id":"CVE-2026-82210","kind":"vulnerability","aliases":["CVE-2026-82210"],"related":[],"title":"bRPC: malformed stream feedback frame crashes the whole server process","description":"Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.\n\nRoot Cause:\nWhen handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service.\n\nAffected Scenarios:\nUse bRPC server with the streaming control feature (Stream API) served from untrusted network.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3494 \n\nThe fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.","summary":"Apache bRPC versions before 1.18.0 hit failed CHECK assertions in the streaming feature when a feedback frame carries an unexpected payload or arrives on a stream without flow control. An attacker who can open a stream can make the server process abort.","severity":"high","cvss":null,"epss":0.00188,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brpc","c++","internet-facing","runtime","self-hosted"],"not_affected_if":["no-streaming-api","trusted-network-only"],"how_to_check":"- Check the bRPC version in use, for example `grep -r BRPC_VERSION` in the build or `unknown` if not declared\n- Look for use of the Stream API (streaming control) in the server code\n- Confirm whether the server accepts connections from untrusted networks","fix":"- Upgrade bRPC to `1.18.0`\n- Or apply the patch from https://github.com/apache/brpc/pull/3494 if an upgrade is not possible","status":"open","published_at":"2026-10-21T13:20:02+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:31+00:00","updated_at":"2026-10-25T05:02:31+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:02:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bRPC to `1.18.0`\n- Or apply the patch from https://github.com/apache/brpc/pull/3494 if an upgrade is not possible","reach":"internet","title":"bRPC: malformed stream feedback frame crashes the whole server process","impact":"low","summary":"Apache bRPC versions before 1.18.0 hit failed CHECK assertions in the streaming feature when a feedback frame carries an unexpected payload or arrives on a stream without flow control. An attacker who can open a stream can make the server process abort.","category":"runtime","nicknames":[],"who_cares":["bRPC","c++","self-hosted","internet-facing"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote client crashes the server process, causing denial of service","analyst_note":"","how_to_check":"- Check the bRPC version in use, for example `grep -r BRPC_VERSION` in the build or `unknown` if not declared\n- Look for use of the Stream API (streaming control) in the server code\n- Confirm whether the server accepts connections from untrusted networks","needs_analyst":false,"not_affected_if":["no-streaming-api","trusted-network-only"],"who_is_affected":"Servers built on Apache bRPC that use the streaming control feature (Stream API) and accept traffic from untrusted networks. Services that do not use streaming, or that only run on trusted internal networks, are less exposed. The sources do not say which default configuration, if any, enables streaming.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":3717,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82210':13A,16A '/apache/brpc/pull/3494':216C '0':116C,150C,249C '1':200C '1.18.0':30B,78C,205C '2':210C 'abort':67B,158C 'affect':181C,229C 'allow':82C,161C 'apach':26B,75C 'api':192C 'appli':211C 'arriv':48B 'assert':34B,69C,119C,153C 'attack':56B,85C 'bound':239C 'brpc':1A,17B,27B,76C,106C,184C,202C 'buf':114C,148C,244C 'buf.isempty':121C 'buffer':240C 'c':18B 'call':107C 'carri':43B,130C 'caus':99C,176C 'check':33B,112C,120C,156C 'client':165C 'close':226C 'contain':111C 'control':54B,144C,189C,252C 'crash':6A,87C,233C 'cur':113C,147C,243C 'cve':11A,14A 'denial':178C 'disabl':146C 'drop':247C 'enabl':254C 'enforc':68C 'eproto':224C 'establish':170C 'face':21B 'fail':32B 'failur':155C,157C 'featur':38B,73C,190C 'feedback':4A,41B,96C,104C,127C,136C,221C 'fix':199C,207C,218C 'flow':53B,143C,251C 'frame':5A,42B,97C,102C,105C,124C,128C,137C,222C 'github.com':215C 'github.com/apache/brpc/pull/3494':214C 'handl':101C 'hit':31B 'host':25B 'instead':231C 'internet':20B 'internet-fac':19B 'issu':209C 'make':63B 'malform':2A,94C,220C 'network':196C 'never':246C 'open':59B 'patch':213C 'payload':46B,125C,133C 'platform':81C 'process':10A,66B,90C,160C,236C 'reach':151C 'receiv':138C 'reject':219C 'remot':84C 'root':98C 'runtim':22B 'scenario':182C 'self':24B 'self-host':23B 'send':92C 'serv':193C 'server':9A,65B,89C,174C,185C 'servic':180C 'setremoteconsum':109C 'shrink':241C 'singl':164C 'size':115C,149C,245C 'stream':3A,37B,51B,61B,72C,95C,108C,141C,168C,188C,191C,230C 'termin':172C 'type':103C 'unauthent':163C 'uncondit':118C 'unexpect':45B,132C 'untrust':195C 'upgrad':201C 'use':183C 'version':28B,77C,204C 'whole':8A,235C 'without':52B","nicknames":[],"mitigations":[],"who_affected":"Servers built on Apache bRPC that use the streaming control feature (Stream API) and accept traffic from untrusted networks. Services that do not use streaming, or that only run on trusted internal networks, are less exposed. The sources do not say which default configuration, if any, enables streaming.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:20:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82210","severity":null,"published_at":"2026-10-21T13:20:02+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-82210","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82210","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}