CVE-2026-82942

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82942", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-31T12:23:58.368Z", "datePublished": "2026-10-21T12:07:15.689Z", "dateUpdated": "2026-10-30T14:35:42.017Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T12:07:15.689Z"}, "title": "Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service", "problemTypes": [{"descriptions": [{"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en", "cweId": "CWE-362", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "packageURL": "pkg:github/apache/brpc", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://github.com", "packageName": "apache/brpc"}], "descriptions": [{"value": "A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime.\n\nRoot Cause:\nWhen a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact).\n\nAffected Scenarios:\nUse a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3505", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A data race in the RDMA transport of Apache bRPC (versions &lt; 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime.<br><br>Root Cause:<br>When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact).<br><br>Affected Scenarios:<br>Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected.<br><br>How to Fix:<br>(Choose one of the following options)<br>1. Upgrade bRPC to version 1.18.0, which fixes this issue.<br>2. Apply this patch: <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3505\">https://github.com/apache/brpc/pull/3505</a>"}]}], "references": [{"url": "https://github.com/apache/brpc/issues/3479"}, {"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "bzs1118", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T14:35:34.252340Z", "id": "CVE-2026-82942", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T14:35:42.017Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82942", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-31T12:23:58.368Z", "datePublished": "2026-10-21T12:07:15.689Z", "dateUpdated": "2026-10-30T14:35:42.017Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T12:07:15.689Z"}, "title": "Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service", "problemTypes": [{"descriptions": [{"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en", "cweId": "CWE-362", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "packageURL": "pkg:github/apache/brpc", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://github.com", "packageName": "apache/brpc"}], "descriptions": [{"value": "A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime.\n\nRoot Cause:\nWhen a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact).\n\nAffected Scenarios:\nUse a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3505", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A data race in the RDMA transport of Apache bRPC (versions &lt; 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime.<br><br>Root Cause:<br>When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact).<br><br>Affected Scenarios:<br>Use a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected.<br><br>How to Fix:<br>(Choose one of the following options)<br>1. Upgrade bRPC to version 1.18.0, which fixes this issue.<br>2. Apply this patch: <a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3505\">https://github.com/apache/brpc/pull/3505</a>"}]}], "references": [{"url": "https://github.com/apache/brpc/issues/3479"}, {"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "bzs1118", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-82942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T14:35:34.252340Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T14:35:27.208Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com", "defaultStatus": "unaffected", "packageName": "apache/brpc", "packageURL": "pkg:github/apache/brpc", "product": "Apache bRPC", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.18.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime.\n\nRoot Cause:\nWhen a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server kept parsing that fd afterwards as if it were still an RPC channel. The TCP-fd input stream and the RDMA QP input stream (driven by CQ events) shared the same Socket::_read_buf, preferred_index and parsing_context without synchronization. In addition, CQ event processing could start while the handshake parsing was still in progress, and the handshake ACK phase could consume bytes belonging to the next protocol. A remote, unauthenticated client that has completed the RDMA handshake can send data on the TCP fd at the same time RDMA messages are being processed, corrupting the shared input buffer and parser state and crashing the server process (CWE-362, availability impact).\n\nAffected Scenarios:\nUse a bRPC server with RDMA support enabled (built with BRPC_WITH_RDMA and serving rdma:// / SOCKET_MODE_RDMA sockets) and accept connections from untrusted clients. Deployments without RDMA are not affected.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3505"}, {"lang": "es", "value": "Una condici\u00f3n de carrera en el transporte RDMA de Apache bRPC (versiones anteriores a la 1.18.0) permite que un cliente remoto provoque la ca\u00edda del proceso del servidor (denegaci\u00f3n de servicio) cuando RDMA est\u00e1 habilitado en tiempo de compilaci\u00f3n y ejecuci\u00f3n.\\n\\nCausa ra\u00edz:\\nCuando un servidor bRPC negocia RDMA con un cliente, el apret\u00f3n de manos se completa en el descriptor TCP fd, pero el servidor sigui\u00f3 analizando ese fd despu\u00e9s como si siguiera siendo un canal RPC. El flujo de entrada del descriptor TCP fd y el flujo de entrada RDMA QP (impulsado por eventos CQ) compart\u00edan el mismo Socket::_read_buf, preferred_index y parsing_context sin sincronizaci\u00f3n. Adem\u00e1s, el procesamiento de eventos CQ pod\u00eda iniciarse mientras el an\u00e1lisis del apret\u00f3n de manos a\u00fan estaba en curso, y la fase ACK del apret\u00f3n de manos pod\u00eda consumir bytes pertenecientes al siguiente protocolo. Un cliente remoto no autenticado que haya completado el apret\u00f3n de manos RDMA puede enviar datos en el descriptor TCP fd al mismo tiempo que se procesan mensajes RDMA, corrompiendo el b\u00fafer de entrada compartido y el estado del analizador y provocando la ca\u00edda del proceso del servidor (CWE-362, impacto de disponibilidad).\\n\\nEscenarios afectados:\\nUtilizar un servidor bRPC con soporte RDMA habilitado (compilado con BRPC_WITH_RDMA y sirviendo sockets rdma:// / SOCKET_MODE_RDMA) y aceptar conexiones de clientes no confiables. Las implementaciones sin RDMA no se ven afectadas.\\n\\nC\u00f3mo corregir:\\n(Elija una de las siguientes opciones)\\n1. Actualizar bRPC a la versi\u00f3n 1.18.0, que corrige este problema.\\n2. Aplicar este parche: https://github.com/apache/brpc/pull/3505"}], "id": "CVE-2026-82942", "lastModified": "2026-10-30T15:16:55.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82942", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T14:35:34.252340Z", "version": "2.0.3"}}]}, "published": "2026-10-21T13:20:03.403", "references": [{"source": "security@apache.org", "url": "https://github.com/apache/brpc/issues/3479"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.18.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache bRPC", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "brpc", "vendor": "apache"}], "created": "2026-10-21T18:30:14.169541+00:00", "updated": "2026-10-30T17:00:20.545274+00:00", "vendors": ["apache", "apache$PRODUCT$brpc"]}