Apache bRPC up to 1.17.x Client Response Path bthread task function exceptional condition

Summaryinfo

A vulnerability was found in Apache bRPC up to 1.17.x. It has been classified as problematic. This vulnerability affects the function bthread task function of the component Client Response Path. Performing a manipulation results in exceptional condition. This vulnerability is cataloged as CVE-2026-82231. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Apache bRPC up to 1.17.x. It has been classified as problematic. This affects the function bthread task function of the component Client Response Path. The manipulation with an unknown input leads to a exceptional condition vulnerability. CWE is classifying the issue as CWE-755. The product does not handle or incorrectly handles an exceptional condition. This is going to have an impact on availability. The summary by CVE is:

A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::length_error). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC. This is the client response path, so the adversary is the server peer, which THREAT_MODEL.md treats as untrusted. It requires a WITH_THRIFT build (off by default). How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3500

It is possible to read the advisory at lists.apache.org. This vulnerability is uniquely identified as CVE-2026-82231 since 08/28/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2026).

Upgrading to version 1.18.0 eliminates this vulnerability. Applying the patch 3500 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Apache

Name

• bRPC

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion