CVE-2026-82231

HighCVSS 7.5/10Last modified Oct 30, 2026

Description

A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::length_error). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC.

This is the client response path, so the adversary is the server peer, which THREAT_MODEL.md treats as untrusted. It requires a WITH_THRIFT build (off by default).

How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3500

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache bRPC	< 1.18.0

References

https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Timeline

Published: Oct 21, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-822329.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator wi CVE-2026-822335.7SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without CVE-2026-822348.2SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform CVE-2026-822355.9filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger b CVE-2026-822363.1File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared f CVE-2026-822373.1filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share re CVE-2026-822383.1filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declar CVE-2026-822398.1Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASI CVE-2026-82247.5A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function pcf_sess_set_ipv6prefix of the file /src/pcf/c CVE-2026-822408.1Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an aut CVE-2026-822417.1Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its defa CVE-2026-822427.7Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows auth