Data Race Vulnerability in Apache bRPC Affects RDMA Transport

CVE-2026-82942

What is CVE-2026-82942?

A data race vulnerability exists in the RDMA transport of Apache bRPC versions prior to 1.18.0. This issue may result in a denial of service when RDMA is enabled at both build and runtime. The vulnerability arises when a bRPC server, during its handshake with a client, continues to parse the TCP file descriptor as if it were still an active RPC channel, leading to shared state corruption. An unauthenticated remote client can trigger this vulnerability by sending data through the TCP connection concurrently with RDMA messages being processed. This can cause the server to crash, disrupting service availability. To mitigate this vulnerability, users are advised to upgrade to bRPC version 1.18.0 or apply the patch available at https://github.com/apache/brpc/pull/3505.

References