CVE-2026-82210

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description An enforceable assertion in the streaming feature allows a remote, unauthenticated attacker to crash the server process, leading to a denial of service. This occurs when the server handles FRAME TYPE FEEDBACK frames and calls the Stream::SetRemoteConsumed() function. The process aborts if a feedback frame contains an unexpected payload or is received on a stream where flow control is disabled, triggering failures in the CHECK( cur buf size > 0) and CHECK(buf.IsEmpty()) assertions.

Recommendations Update to version 1.18.0. Apply the patch provided in pull request 3494.