{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "product": "Apache bRPC",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Claude"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through\u0026nbsp; 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional stream. The response handling path indexed the returned identifiers using the locally created stream count without first validating the size of the returned list, so a malicious or compromised server (or an on-path attacker) can trigger an out-of-bounds read in the client by returning a malformed StreamSettings response with fewer extra_stream_ids than expected. This may crash the client process (denial of service) or leak unintended memory contents into subsequent stream handling; surplus identifiers have no valid client-stream mapping and are processed inconsistently.\u003cbr\u003e\u003cbr\u003eRoot Cause:\u003cbr\u003eSince bRPC 1.11.0, a client can create multiple streams in one RPC via batch StreamCreate. The expected behavior is that the server response must return exactly (N-1) extra_stream_ids, where N is the number of locally created streams. In Controller::HandleStreamConnection, the response path reads extra_stream_ids[i-1] for each additional local stream without first comparing the returned list size with (N-1). If the server returns fewer identifiers, the read runs past the end of the returned list (out-of-bounds read); if it returns more, the surplus identifiers have no corresponding client-side stream.\u003cbr\u003e\u003cbr\u003eAffected Scenarios:\u003cbr\u003eA bRPC client using multi-stream RPC (creating more than one stream in a single RPC) that connects to an untrusted, malicious, or compromised server or to a server reached through an untrusted network path. The server sends a malformed StreamSettings response to trigger the issue.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003eHow to Fix: \u003cbr\u003e(Choose one of the following options)\u0026nbsp;\u003cbr\u003e1. Upgrade bRPC to version 1.18.0, which fixes this issue.\u003cbr\u003e2. Apply this patch: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3485\"\u003ehttps://github.com/apache/brpc/pull/3485\u003c/a\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003eNote:\u003cbr\u003eThe fix makes the client reject responses whose extra_stream_ids count does not exactly match the number of additional client streams. Such mismatched responses now fail the RPC with ERESPONSE and go through the existing stream cleanup path, instead of being partially processed."
            }
          ],
          "value": "An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through\u00a0 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional stream. The response handling path indexed the returned identifiers using the locally created stream count without first validating the size of the returned list, so a malicious or compromised server (or an on-path attacker) can trigger an out-of-bounds read in the client by returning a malformed StreamSettings response with fewer extra_stream_ids than expected. This may crash the client process (denial of service) or leak unintended memory contents into subsequent stream handling; surplus identifiers have no valid client-stream mapping and are processed inconsistently.\n\nRoot Cause:\nSince bRPC 1.11.0, a client can create multiple streams in one RPC via batch StreamCreate. The expected behavior is that the server response must return exactly (N-1) extra_stream_ids, where N is the number of locally created streams. In Controller::HandleStreamConnection, the response path reads extra_stream_ids[i-1] for each additional local stream without first comparing the returned list size with (N-1). If the server returns fewer identifiers, the read runs past the end of the returned list (out-of-bounds read); if it returns more, the surplus identifiers have no corresponding client-side stream.\n\nAffected Scenarios:\nA bRPC client using multi-stream RPC (creating more than one stream in a single RPC) that connects to an untrusted, malicious, or compromised server or to a server reached through an untrusted network path. The server sends a malformed StreamSettings response to trigger the issue.\n\n\nHow to Fix: \n(Choose one of the following options)\u00a0\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3485 \n\n\nNote:\nThe fix makes the client reject responses whose extra_stream_ids count does not exactly match the number of additional client streams. Such mismatched responses now fail the RPC with ERESPONSE and go through the existing stream cleanup path, instead of being partially processed."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "medium"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T11:56:20.309Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-79704",
    "datePublished": "2026-10-21T11:56:20.309Z",
    "dateReserved": "2026-08-25T12:37:38.744Z",
    "dateUpdated": "2026-10-21T11:56:20.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-79704",
      "date": "2026-10-27",
      "epss": "0.00164",
      "percentile": "0.05602"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://github.com",
                "defaultStatus": "unaffected",
                "packageName": "apache/brpc",
                "packageURL": "pkg:github/apache/brpc",
                "product": "Apache bRPC",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "1.18.0",
                    "status": "affected",
                    "version": "1.11.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through\u00a0 1.17.0) on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional stream. The response handling path indexed the returned identifiers using the locally created stream count without first validating the size of the returned list, so a malicious or compromised server (or an on-path attacker) can trigger an out-of-bounds read in the client by returning a malformed StreamSettings response with fewer extra_stream_ids than expected. This may crash the client process (denial of service) or leak unintended memory contents into subsequent stream handling; surplus identifiers have no valid client-stream mapping and are processed inconsistently.\n\nRoot Cause:\nSince bRPC 1.11.0, a client can create multiple streams in one RPC via batch StreamCreate. The expected behavior is that the server response must return exactly (N-1) extra_stream_ids, where N is the number of locally created streams. In Controller::HandleStreamConnection, the response path reads extra_stream_ids[i-1] for each additional local stream without first comparing the returned list size with (N-1). If the server returns fewer identifiers, the read runs past the end of the returned list (out-of-bounds read); if it returns more, the surplus identifiers have no corresponding client-side stream.\n\nAffected Scenarios:\nA bRPC client using multi-stream RPC (creating more than one stream in a single RPC) that connects to an untrusted, malicious, or compromised server or to a server reached through an untrusted network path. The server sends a malformed StreamSettings response to trigger the issue.\n\n\nHow to Fix: \n(Choose one of the following options)\u00a0\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3485 \n\n\nNote:\nThe fix makes the client reject responses whose extra_stream_ids count does not exactly match the number of additional client streams. Such mismatched responses now fail the RPC with ERESPONSE and go through the existing stream cleanup path, instead of being partially processed."
          },
          {
            "lang": "es",
            "value": "Existe una vulnerabilidad de lectura fuera de los l\u00edmites en el cliente RPC de transmisi\u00f3n de Apache bRPC (desde la versi\u00f3n 1.11.0 hasta la versi\u00f3n 1.17.0 inclusive) en todas las plataformas. Un cliente que crea m\u00faltiples flujos en una \u00fanica llamada RPC espera que la respuesta del servidor incluya exactamente un extra_stream_id por cada flujo adicional. La ruta de manejo de la respuesta indexa los identificadores devueltos usando el recuento de flujos creados localmente sin validar primero el tama\u00f1o de la lista devuelta, de modo que un servidor malicioso o comprometido (o un atacante en la ruta) puede provocar una lectura fuera de los l\u00edmites en el cliente al devolver una respuesta StreamSettings malformada con menos extra_stream_ids de los esperados. Esto puede bloquear el proceso del cliente (denegaci\u00f3n de servicio) o filtrar contenido de memoria no intencionado en el manejo de flujos subsiguientes; los identificadores sobrantes no tienen una asignaci\u00f3n v\u00e1lida a un flujo del cliente y se procesan de forma inconsistente.\\n\\nCausa ra\u00edz:\\nDesde bRPC 1.11.0, un cliente puede crear m\u00faltiples flujos en una \u00fanica RPC mediante StreamCreate por lotes. El comportamiento esperado es que la respuesta del servidor devuelva exactamente (N?1) extra_stream_ids, donde N es el n\u00famero de flujos creados localmente. En Controller::HandleStreamConnection, la ruta de respuesta lee extra_stream_ids[i?1] para cada flujo local adicional sin comparar primero el tama\u00f1o de la lista devuelta con (N?1). Si el servidor devuelve menos identificadores, la lectura avanza m\u00e1s all\u00e1 del final de la lista (lectura fuera de los l\u00edmites); si devuelve m\u00e1s, los identificadores sobrantes no tienen un flujo correspondiente del lado del cliente.\\n\\nEscenarios afectados:\\nUn cliente bRPC que utiliza RPC de multifujo (creando m\u00e1s de un flujo en una \u00fanica RPC) y se conecta a un servidor no confiable, malicioso o comprometido, o a un servidor al que se accede a trav\u00e9s de una ruta de red no confiable. El servidor env\u00eda una respuesta StreamSettings malformada para desencadenar el problema.\\n\\nC\u00f3mo corregir:\\n(Elija una de las siguientes opciones)\\n1. Actualizar bRPC a la versi\u00f3n 1.18.0, que corrige este problema.\\n2. Aplicar este parche: https://github.com/apache/brpc/pull/3485\\n\\nNota:\\nLa correcci\u00f3n hace que el cliente rechace respuestas cuyo recuento de extra_stream_ids no coincida exactamente con el n\u00famero de flujos adicionales del cliente. Estas respuestas incompatibles ahora fallan la RPC con ERESPONSE y siguen la ruta de limpieza de flujos existente, en lugar de procesarse parcialmente."
          }
        ],
        "id": "CVE-2026-79704",
        "lastModified": "2026-10-26T20:10:00.160",
        "metrics": {},
        "published": "2026-10-21T12:17:23.787",
        "references": [
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "security@apache.org",
            "type": "Primary"
          }
        ]
      }
    }
  }
}