Live › vulnerability › CVE-2026-90484
Go to dashboardThe MySQL client response parser in Apache bRPC dereferences a null pointer when a server sends a zero-payload-length packet. An attacker running a malicious or man-in-the-middle MySQL server can crash the bRPC client process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only applications using bRPC's MySQL client to connect to a MySQL server that may be malicious or reachable by a man-in-the-middle. Teams whose bRPC use does not include the MySQL client, or who only talk to trusted MySQL servers, are at much lower risk.
No product ranges from the sources yet.
1.18.0 (per the fix note)brpc::policy::MysqlReply or brpc/mysql.h includes) in the codebase1.18.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (is_full_package), after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, and type = p[4] dereferences it, crashing the client process.
Root Cause: In brpc::policy::MysqlReply::ConsumePartialIOBuf, buf.fetch(header, 5) returns nullptr when the buffered data only holds the 4-byte header of a zero-length packet, then the code reads p[4] (and, in the fast-auth path, p2[4]) without checking for a null or zero-length packet.
Affected Scenarios: A brpc MySQL client connecting to a malicious or compromised MySQL server (or a MITM) can be crashed by a zero-length server response packet, resulting in denial of service of the client.
Fix: The fix rejects zero-length response packets (returning PARSE_ERROR_ABSOLUTELY_WRONG) both for the initial response type determination and after a fast-auth marker, before reading the type byte. Upgrade to the Apache bRPC version 1.18.0 or apply the PR patch at https://github.com/apache/brpc/pull/3536.
This page as .md · .json · in your agent: get_signal("CVE-2026-90484")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.