Denial of Service Vulnerability in Apache bRPC Streaming Feature

CVE-2026-82210

What is CVE-2026-82210?

A vulnerability exists in the streaming feature of Apache bRPC prior to version 1.18.0 that allows a remote attacker to crash the server by sending a malformed stream feedback frame. This vulnerability stems from inadequacies in handling FRAME_TYPE_FEEDBACK frames, where incorrect payloads or feedback frames sent when flow control is disabled trigger assertions leading to server crashes. An unauthenticated client can exploit this issue, resulting in a denial of service. To mitigate this risk, it is recommended to upgrade to bRPC version 1.18.0 or apply the provided patch, which improves robustness by rejecting malformed frames and preventing server process termination.

References