CVE-2026-82942

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82942
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82942.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82942
Published
2026-10-21T12:07:15Z
Modified
2026-10-22T02:48:56Z
Summary
Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
Details

A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime.

Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact).

Affected Scenarios: Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected.

How to Fix: (Choose one of the following options)

  1. Upgrade bRPC to version 1.18.0, which fixes this issue.
  2. Apply this patch: https://github.com/apache/brpc/pull/3505
Database specific 
{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-362"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82942.json"
}
References

Affected packages

Git / github.com/apache/brpc

Affected ranges

Type
GIT
Repo
https://github.com/apache/brpc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
94f1bbd32845a45f0218dfe43e25791252bdcb72
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.18.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

0.*
0.9.5
0.9.6
0.9.6-rc01
0.9.6-rc02
0.9.6-rc03
0.9.7
0.9.7-rc01
0.9.7-rc02
0.9.7-rc03
0.9.8-rc01
1.*
1.0.0
1.0.0-rc01
1.0.0-rc02
1.13.0
v0.*
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82942.json"