{"identifier":"CVE-2026-82210","cve":{"id":"CVE-2026-82210","description":"Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame.\n\nRoot Cause:\nWhen handling FRAME_TYPE_FEEDBACK frames, bRPC calls Stream::SetRemoteConsumed() which contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled (cur_buf_size == 0), reaches these assertions. On failure, CHECK failures abort the process, allowing an unauthenticated single client (once a stream is established) to terminate the server and cause a denial of service.\n\nAffected Scenarios:\nUse bRPC server with the streaming control feature (Stream API) served from untrusted network.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3494 \n\nThe fix rejects malformed feedback frames with EPROTO and closes only the affected stream instead of crashing the whole process, and it bounds buffer shrinking so cur_buf_size never drops to 0 while flow control is enabled.","published":"2026-10-21T13:20:02.837000+00:00","modified":"2026-10-26T23:10:00.183000+00:00","status":"Deferred","score":null,"severity":"UNSCORED","vector":"","cvss_version":"","affected":[],"weaknesses":["CWE-617"],"references":[{"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb","source":"security@apache.org"}],"kev":null,"kev_checked":true,"metrics":{},"configurations":[],"source":"nvd","retrieved_at":"2026-10-28T10:26:27.648391+00:00","exploited":false,"kev_stale":false,"products":[],"priority":{"label":"Assess exposure and vendor guidance","reasons":["No higher-priority signal is available in the current stored evidence."]},"epss":{"probability":0.00188,"percentile":0.08412,"date":"2026-10-28","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"lists.apache.org","source_url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb","investigate_url":"https://investigate.aeglixmind.com/#lists.apache.org"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-82210","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-82210","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-82210","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}