Thrift Client Vulnerability in Apache bRPC Affects Untrusted Server Peers

CVE-2026-82231

What is CVE-2026-82231?

A vulnerability exists in the Apache bRPC Thrift client that can lead to a crash when interacting with an untrusted server peer. Specifically, if the server returns a malformed T_EXCEPTION response, the client fails to handle the exception properly, leading to a process termination. This issue is prevalent in all versions prior to 1.18.0 and requires a build with WITH_THRIFT enabled, which is off by default. To mitigate this vulnerability, users should upgrade to bRPC version 1.18.0 or apply the recommended patch. For detailed guidance, refer to the Apache advisory.

References