CVE-2026-79704

Name of the Vulnerable Software and Affected Versions Apache bRPC versions 1.11.0 through 1.17.0

Description An out-of-bounds read exists in the streaming RPC client across all platforms. When a client creates multiple streams in a single RPC, it expects the server response to contain exactly one extra stream id for every additional stream. The response handling path in the Controller::HandleStreamConnection() function indexes the returned identifiers using the locally created stream count without validating the size of the returned list. A malicious or compromised server, or an on-path attacker, can trigger this by returning a malformed StreamSettings response with fewer extra stream ids than expected. This can lead to a client process crash (denial of service) or the leakage of unintended memory contents into subsequent stream handling.

Recommendations Upgrade Apache bRPC to version 1.18.0. Apply the official patch for the Controller::HandleStreamConnection() function to ensure the client rejects responses where the extra stream id count does not match the number of additional client streams.