---
id: "CVE-2026-82210"
kind: "vulnerability"
aliases: ["CVE-2026-82210"]
title: "bRPC: malformed stream feedback frame crashes the whole server process"
severity: "high"
cvss: null
epss: 0.00188
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["brpc", "c++", "internet-facing", "runtime", "self-hosted"]
not_affected_if: ["no-streaming-api", "trusted-network-only"]
published_at: "2026-10-21T13:20:02+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T05:02:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82210", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-82210", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# bRPC: malformed stream feedback frame crashes the whole server process

Apache bRPC versions before 1.18.0 hit failed CHECK assertions in the streaming feature when a feedback frame carries an unexpected payload or arrives on a stream without flow control. An attacker who can open a stream can make the server process abort.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the bRPC version in use, for example `grep -r BRPC_VERSION` in the build or `unknown` if not declared
- Look for use of the Stream API (streaming control) in the server code
- Confirm whether the server accepts connections from untrusted networks

## Fix

- Upgrade bRPC to `1.18.0`
- Or apply the patch from https://github.com/apache/brpc/pull/3494 if an upgrade is not possible

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82210
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-82210

## From the sources

Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.

Root Cause:
When handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service.

Affected Scenarios:
Use bRPC server with the streaming control feature (Stream API) served from untrusted network.

How to Fix:
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch:  https://github.com/apache/brpc/pull/3494 

The fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_