Race condition in Apache bRPC - CVE-2026-82942
Published: October 23, 2026
Vulnerability identifier: #VU157361
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-82942
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC server process.
The vulnerability exists due to a race condition in Apache bRPC's RDMA transport when TCP and RDMA input paths access the same socket input buffer and parser state without synchronization after negotiation. A remote attacker can complete the RDMA handshake and send TCP data while RDMA messages are being processed to corrupt the shared input state and crash the server.
RDMA must be enabled at build time and runtime; deployments without RDMA are not affected.
Affected software
Apache bRPC
How to mitigate CVE-2026-82942
Install security update from vendor's website.
Apache bRPC - update to 1.18.0