---
id: "CVE-2026-82231"
kind: "vulnerability"
aliases: ["CVE-2026-82231"]
title: "bRPC Thrift client: malformed server reply crashes the whole process"
severity: "medium"
cvss: null
epss: 0.00147
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["brpc", "c++", "package", "rpc-clients", "thrift"]
not_affected_if: ["brpc-1.18.0-or-later", "default-config", "no-thrift-client"]
published_at: "2026-10-21T13:20:03+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T05:02:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82231", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-82231", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# bRPC Thrift client: malformed server reply crashes the whole process

A Thrift client in Apache bRPC built with WITH_THRIFT does not catch Thrift decode exceptions when a server returns a malformed T_EXCEPTION reply. The uncaught exception calls std::terminate(), which kills the process and every other in-flight RPC.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the bRPC version in use, for example with `grep -i brpc` in your build files or `ldd` on the binary, and confirm whether it is below `1.18.0`.
- Check whether the build enabled Thrift support: look for `WITH_THRIFT=ON` in the build configuration or CMake cache.
- Confirm the process uses the Thrift client protocol to talk to servers you do not fully control.

## Fix

- Upgrade bRPC to `1.18.0`.
- Or apply the patch from https://github.com/apache/brpc/pull/3500 if you cannot upgrade yet.
- Or rebuild without `WITH_THRIFT` if Thrift client support is not needed.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82231
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-82231

## From the sources

A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::length_error). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC.

This is the client response path, so the adversary is the server peer, which THREAT_MODEL.md treats as untrusted. It requires a WITH_THRIFT build (off by default).

How to Fix:
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3500

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_