Apache bRPC Null Pointer Dereference in MySQL Client

CVE-2026-90484

What is CVE-2026-90484?

The MySQL client response parser in Apache bRPC is susceptible to a null pointer dereference, which can occur when the server sends a zero-payload-length response packet. This vulnerability arises when the response type byte is fetched without proper validation, leading to a crash of the client process. A malicious or compromised MySQL server can exploit this flaw to trigger a denial of service on the affected brpc MySQL client. To mitigate this issue, upgrade to Apache bRPC version 1.18.0 or implement the recommended patch available at the provided GitHub link.

References