{"id":"CVE-2026-82231","published":"2026-10-21T13:20:03.100","lastModified":"2026-10-26T21:10:00.170","description":"A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply whose exception struct is malformed, the client decodes it without catching what Apache Thrift throws (TProtocolException, TTransportException or std::length_error). The exception unwinds out of the bthread task function and the process calls std::terminate(), terminating the whole process along with every other in-flight RPC.\n\nThis is the client response path, so the adversary is the server peer, which THREAT_MODEL.md treats as untrusted. It requires a WITH_THRIFT build (off by default).\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3500","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-248"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}