CVE-2026-82210 Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames

Enforceable assertion in the streaming feature of Apache bRPC version 0 and unconditionally asserts CHECKbuf.IsEmpty on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled curbufsize == 0, reaches these...

CVE-2026-82210

Apache bRPC versions earlier than 1.18.0 are vulnerable to a Remote Denial of Service (DoS) via a reachable assertion (CWE-617 ). The issue occurs in the streaming feature when the server handles FRAME_TYPE_FEEDBACK frames. Specifically, the Stream::SetRemoteConsumed() function contains assertion...