CVE-2026-82942— Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
Quick assessment
Affected
Apache Software Foundation Apache bRPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Apache bRPC（版本 < 1.18.0）的 RDMA 传输层中存在数据竞争漏洞。当编译时和运行时均启用了 RDMA 功能时，远程客户端可利用该漏洞导致服务器进程崩溃，从而引发拒绝服务（DoS）攻击。 根本原因： 当 bRPC 服务器与客户端协商 RDMA 连接时，握手过程在 TCP 文件描述符（fd）上完成，但此后服务器仍将该 fd 当作普通的 RPC 通道继续解析。TCP fd 的输入流与由完成队列（CQ）事件驱动的 RDMA 队列对（QP）输入流，共享了同一个 、 和 ，且未进行任何同步保护。此外，
Possible ATT&CK Techniques 1 AI
T1499.001 · OS Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82942
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime.
Root Cause:
When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact).
Affected Scenarios:
Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3505
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache bRPC | 0 ~ 1.18.0 | - |
|
II. Public POCs for CVE-2026-82942
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82942
请登录查看更多情报信息。
Other References for CVE-2026-82942 (2)
-
https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-10-21 · 39 CVEs total
| CVE-2026-56386 | Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser | |
| CVE-2026-74758 | Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling | |
| CVE-2026-74757 | Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count | |
| CVE-2026-74755 | Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service | |
| CVE-2026-66392 | Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names | |
| CVE-2026-61916 | Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms | |
| CVE-2026-61902 | Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits | |
| CVE-2026-58064 | Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation | |
| CVE-2026-56388 | Apache bRPC: Out-of-Bounds Write in Redis Command Parser | |
| CVE-2026-56387 | Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser | |
| CVE-2026-78048 | Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Deco | |
| CVE-2026-54427 | Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser | |
| CVE-2026-54426 | Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser | |
| CVE-2026-54425 | Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding | |
| CVE-2026-48830 | Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for | |
| CVE-2026-59229 | Apache IoTDB: Legacy Pipe Privilege Escalation | |
| CVE-2026-59562 | Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe send | |
| CVE-2026-41114 | Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JD | |
| CVE-2026-58663 | Apache IoTDB: Auth Bypass in pipeTransfer() interface | |
| CVE-2026-82231 | Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift clien |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache bRPC
-
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser -
CVE-2026-87849
Apache bRPC: Out-of-bounds read via non-object fields in Dis -
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-86147
Apache bRPC: Arbitrary file creation/truncation via /flags a -
CVE-2026-86146
Apache bRPC: HTTP Request Smuggling and Header Injection via
Same vendor: Apache Software Foundation
-
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser -
CVE-2026-87849
Apache bRPC: Out-of-bounds read via non-object fields in Dis -
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-86147
Apache bRPC: Arbitrary file creation/truncation via /flags a -
CVE-2026-86146
Apache bRPC: HTTP Request Smuggling and Header Injection via
Same weakness: CWE-362
-
CVE-2026-113707
a2aproject a2a-rs inmemory.rs update race condition -
CVE-2026-19178
TS4500 Tape Library Race Condition -
CVE-2026-85248
Apache Camel: Camel-PQC Signature Verification Bypass via a -
CVE-2026-111449
Wheels 4.1.1 之前版本存在敏感信息泄露漏洞 -
CVE-2026-101311
Multiple vulnerabilities in bhyve device models
V. Comments for CVE-2026-82942
No comments yet