CVE-2026-79704 in bRPC
Summary
by MITRE • 10/21/2026
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional stream. The response handling path indexed the returned identifiers using the locally created stream count without first validating the size of the returned list, so a malicious or compromised server (or an on-path attacker) can trigger an out-of-bounds read in the client by returning a malformed StreamSettings response with fewer extra_stream_ids than expected. This may crash the client process (denial of service) or leak unintended memory contents into subsequent stream handling; surplus identifiers have no valid client-stream mapping and are processed inconsistently.
Root Cause: Since bRPC 1.11.0, a client can create multiple streams in one RPC via batch StreamCreate. The expected behavior is that the server response must return exactly (N-1) extra_stream_ids, where N is the number of locally created streams. In Controller::HandleStreamConnection, the response path reads extra_stream_ids[i-1] for each additional local stream without first comparing the returned list size with (N-1). If the server returns fewer identifiers, the read runs past the end of the returned list (out-of-bounds read); if it returns more, the surplus identifiers have no corresponding client-side stream.
Affected Scenarios: A bRPC client using multi-stream RPC (creating more than one stream in a single RPC) that connects to an untrusted, malicious, or compromised server or to a server reached through an untrusted network path. The server sends a malformed StreamSettings response to trigger the issue.
How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3485
Note: The fix makes the client reject responses whose extra_stream_ids count does not exactly match the number of additional client streams. Such mismatched responses now fail the RPC with ERESPONSE and go through the existing stream cleanup path, instead of being partially processed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Apache bRPC versions 1.11.0 through 1.17.0 represents a critical out-of-bounds read condition within the streaming Remote Procedure Call client implementation. This flaw specifically affects systems utilizing multi-stream RPC capabilities, where a single request initiates multiple concurrent streams to an endpoint. The core technical deficiency lies in the response handling logic of the Controller::HandleStreamConnection method. When a client creates N streams via batch StreamCreate operations, it anticipates that the server will return exactly one extra_stream_id for each additional stream beyond the first, totaling N-1 identifiers. However, the implementation fails to validate the size of the returned list against this expected count before attempting to index into the array of received identifiers. Consequently, if a malicious or compromised server returns fewer extra_stream_ids than anticipated, the client code proceeds to access memory locations outside the bounds of the allocated response buffer. This behavior is classified under CWE-125 as an out-of-bounds read vulnerability, which poses significant risks including denial of service through application crashes and potential information disclosure via memory leakage.
The operational impact of this vulnerability extends beyond simple process termination. An attacker who can intercept or manipulate network traffic between the client and server, such as an on-path adversary, can craft a malformed StreamSettings response containing fewer extra_stream_ids than required by the protocol specification. Upon receiving this truncated list, the bRPC client attempts to map these identifiers to local stream contexts without verifying their existence in the received data structure. This leads to undefined behavior where the application may crash immediately due to segmentation faults or illegal memory access violations. In scenarios where the read does not cause an immediate crash, sensitive memory contents from adjacent buffers may be exposed and processed incorrectly. These surplus or missing identifiers disrupt the internal state machine of the RPC client, leading to inconsistent stream handling that can corrupt subsequent communications or leak proprietary data structures into untrusted contexts. This aligns with ATT&CK technique T1048, which involves exploitation of protocol weaknesses for denial of service or information gathering.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. The primary recommendation is to upgrade the Apache bRPC library to version 1.18.0 or later, where this logic error has been resolved. For environments unable to perform an immediate upgrade, applying the specific patch provided in pull request 3485 on the official GitHub repository is necessary. This fix enforces strict validation by ensuring that the count of extra_stream_ids in the server response exactly matches the number of additional client streams created during the RPC initiation. If a mismatch occurs, the implementation now rejects the entire response with an ERESPONSE error code and triggers the standard stream cleanup path rather than attempting partial processing. This defensive programming approach prevents out-of-bounds access by failing fast when protocol expectations are not met. Additionally, organizations should consider implementing network-level monitoring to detect anomalous RPC responses from untrusted endpoints, thereby adding a layer of defense-in-depth against exploitation attempts targeting this specific implementation flaw in multi-stream communication channels.