CVE-2026-90484

{"id": "CVE-2026-90484", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-90484", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T13:39:08.583202Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "versions": [{"status": "affected", "version": "<= 1.11.0", "lessThan": "1.18.0", "versionType": "semver"}], "packageURL": "pkg:github/apache/brpc", "packageName": "apache/brpc", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}]}], "published": "2026-10-21T13:20:56.590", "references": [{"url": "https://github.com/apache/brpc/pull/3536", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "source": "security@apache.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (is_full_package), after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, and type = p[4] dereferences it, crashing the client process.\n\n\n\nRoot Cause: In brpc::policy::MysqlReply::ConsumePartialIOBuf, buf.fetch(header, 5) returns nullptr when the buffered data only holds the 4-byte header of a zero-length packet, then the code reads p[4] (and, in the fast-auth path, p2[4]) without checking for a null or zero-length packet.\n\n\n\nAffected Scenarios: A brpc MySQL client connecting to a malicious or compromised MySQL server (or a MITM) can be crashed by a zero-length server response packet, resulting in denial of service of the client.\n\n\n\nFix: The fix rejects zero-length response packets (returning PARSE_ERROR_ABSOLUTELY_WRONG) both for the initial response type determination and after a fast-auth marker, before reading the type byte. Upgrade to the Apache bRPC version 1.18.0 or apply the PR patch at https://github.com/apache/brpc/pull/3536."}, {"lang": "es", "value": "El analizador de respuestas del cliente MySQL en Apache bRPC desreferencia un puntero nulo cuando el servidor remoto env\u00eda un paquete de respuesta con longitud de carga \u00fatil cero. Un paquete de respuesta cuya longitud de carga declarada es cero es aceptado por la verificaci\u00f3n de longitud de trama (is_full_package), despu\u00e9s de lo cual el analizador lee el byte de tipo de respuesta mediante una extracci\u00f3n de 5 bytes sin l\u00edmites que devuelve nullptr, y type = p[4] lo desreferencia, provocando el bloqueo del proceso cliente.\\n\\nCausa ra\u00edz: en brpc::policy::MysqlReply::ConsumePartialIOBuf, buf.fetch(header, 5) devuelve nullptr cuando los datos en b\u00fafer solo contienen el encabezado de 4?bytes de un paquete de longitud cero, y luego el c\u00f3digo lee p[4] (y, en la ruta de autenticaci\u00f3n r\u00e1pida, p2[4]) sin comprobar si es nulo o si el paquete tiene longitud cero.\\n\\nEscenarios afectados: el cliente MySQL de brpc que se conecta a un servidor MySQL malicioso o comprometido (o a un MitM) puede ser bloqueado por un paquete de respuesta del servidor de longitud cero, lo que resulta en una denegaci\u00f3n de servicio del cliente.\\n\\nCorrecci\u00f3n: la correcci\u00f3n rechaza los paquetes de respuesta de longitud cero (devolviendo PARSE_ERROR_ABSOLUTELY_WRONG) tanto para la determinaci\u00f3n inicial del tipo de respuesta como despu\u00e9s de un marcador de autenticaci\u00f3n r\u00e1pida, antes de leer el byte de tipo. Actualice a la versi\u00f3n 1.18.0 de Apache bRPC o aplique el parche PR en https://github.com/apache/brpc/pull/3536."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security@apache.org"}