{"id":"CVE-2026-82210","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-82210","generatedAt":"2026-10-28T03:30:21.117Z","title":"Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.","description":"Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.\n\nRoot Cause:\nWhen handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service.\n\nAffected Scenarios:\nUse bRPC server with the streaming control feature (Stream API) served from untrusted network.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3494 \n\nThe fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.","published":"2026-10-21T13:20:03.000Z","lastModified":"2026-10-26T23:10:00.000Z","status":"Deferred","sourceIdentifier":"security@apache.org","cvss":null,"cwe":["CWE-617"],"affected":[],"epss":{"score":0.00188,"percentile":0.0834,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.00188,"percentile":0.07987}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T13:20:03.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-21T13:20:02.837Z"},"summary":"New CVE, not yet scored."}],"references":[{"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb","source":"security@apache.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-82210","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}