Out-of-Bounds Read Vulnerability in Apache bRPC Streaming RPC Client

CVE-2026-79704

What is CVE-2026-79704?

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0. This flaw occurs when a client creates multiple streams within a single RPC call, expecting the server response to provide an exact number of extra_stream_ids corresponding to the additional streams. Due to improper validation of the response size in the index read, a malicious or compromised server can exploit this by sending a malformed StreamSettings response. This may either crash the client process, resulting in denial of service, or leak sensitive memory data during subsequent stream handling. To mitigate this vulnerability, users are advised to upgrade to bRPC version 1.18.0 or apply an appropriate patch.

References