CVE-2026-82425

{"id": "CVE-2026-82425", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82425", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T14:32:44.834142Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.0", "versionType": "semver"}], "packageURL": "pkg:github/apache/brpc", "packageName": "apache/brpc", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}]}], "published": "2026-10-21T13:20:03.247", "references": [{"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "source": "security@apache.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in denial of service.\n\nRoot Cause:\nWhen a Socket with health checking enabled fails, Socket::WaitAndReset closes its file descriptor while the event dispatcher may still be delivering an input event (EPOLLIN/EVFILT_READ) that was fetched for the just-closed fd. If the health check then succeeds and revives the Socket, Socket::Address succeeds again while the fd is still -1 (the next write reconnects on demand). In that window, Socket::OnInputEvent hits CHECK(!(events & EPOLLIN)) (or the kqueue equivalent) because the Socket is addressable but has no fd. CHECK failures terminate the process when bRPC is built with glog or when the gflag -crash_on_fatal_log is enabled (CHECK always terminates in OFFICIAL_BUILD/NDEBUG builds as well).\n\nAffected Scenarios:\nApplications using bRPC clients with health check enabled (-health_check_interval). A malicious remote peer that the client connects to can deliberately abort connections and immediately accept the health check probes, racing connection teardown against health check revival to trigger the assertion and abort the process.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3510 \n\nNote:\nAfter applying the fix, stale input events on a Socket revived without an fd are silently dropped instead of triggering the assertion. No user-visible interface or wire protocol is changed."}, {"lang": "es", "value": "Una aserci\u00f3n alcanzable en Apache bRPC (versiones anteriores a la 1.18.0) en todas las plataformas permite que un par remoto malicioso provoque el bloqueo del proceso, lo que resulta en una denegaci\u00f3n de servicio.\\n\\nCausa ra\u00edz:\\nCuando un Socket con comprobaci\u00f3n de salud habilitada falla, Socket::WaitAndReset cierra su descriptor de archivo mientras el despachador de eventos a\u00fan puede estar entregando un evento de entrada (EPOLLIN/EVFILT_READ) que se obtuvo para el descriptor reci\u00e9n cerrado. Si la comprobaci\u00f3n de salud entonces tiene \u00e9xito y revive el Socket, Socket::Address vuelve a tener \u00e9xito mientras el descriptor sigue siendo -1 (la siguiente escritura vuelve a conectar bajo demanda). En esa ventana, Socket::OnInputEvent ejecuta CHECK(!(events & EPOLLIN)) (o el equivalente kqueue) porque el Socket es direccionable pero no tiene descriptor. Las fallas de CHECK terminan el proceso cuando bRPC se compila con glog o cuando la gflag -crash_on_fatal_log est\u00e1 habilitada (CHECK siempre termina en compilaciones OFFICIAL_BUILD/NDEBUG tambi\u00e9n).\\n\\nEscenarios afectados:\\nAplicaciones que usan clientes bRPC con la comprobaci\u00f3n de salud habilitada (-health_check_interval). Un par remoto malicioso al que el cliente se conecta puede abortar deliberadamente las conexiones y aceptar inmediatamente las sondas de comprobaci\u00f3n de salud, compitiendo el desmontaje de la conexi\u00f3n contra la reactivaci\u00f3n de la comprobaci\u00f3n de salud para desencadenar la aserci\u00f3n y abortar el proceso.\\n\\nC\u00f3mo corregir:\\n(Elija una de las siguientes opciones)\\n1. Actualice bRPC a la versi\u00f3n 1.18.0, que corrige este problema.\\n2. Aplique este parche: https://github.com/apache/brpc/pull/3510\\n\\nNota:\\nDespu\u00e9s de aplicar la correcci\u00f3n, los eventos de entrada obsoletos en un Socket revivido sin descriptor se descartan silenciosamente en lugar de activar la aserci\u00f3n. No se modifica ninguna interfaz visible para el usuario ni el protocolo de red."}], "lastModified": "2026-10-30T15:16:55.790", "sourceIdentifier": "security@apache.org"}