CVE-2026-82231 Details
Description
A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::length_error). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC. This is the client response path, so the adversary is the server peer, which THREAT_MODEL.md treats as untrusted. It requires a WITH_THRIFT build (off by default). How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3500
A denial-of-service vulnerability has been identified in the Thrift client of Apache bRPC, specifically in versions prior to 1.18.0 and built with the Thrift option enabled. When the client communicates with a server that returns a malformed T_EXCEPTION reply, the client fails to properly handle the exception, allowing it to unwind out of the bthread task function. This oversight causes the process to terminate abruptly, using std::terminate(), which crashes the entire process and disrupts all in-flight RPCs. The vulnerability arises because the Thrift client does not catch exceptions thrown by the Apache Thrift library, such as TProtocolException, TTransportException, or std::length_error. As a result, the client process is terminated, leading to a denial-of-service condition.
Users are advised to upgrade Apache bRPC to version 1.18.0, which addresses this vulnerability. Alternatively, the patch available in PR #3500 can be applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb | [email protected] | AdvisoryBundleMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache bRPC | < 1.18.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | CVE Translated | [email protected] |
| Oct 21, 2026 | New CVE Received | [email protected] |