CVE-2026-82210 Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames

Enforceable assertion in the streaming feature of Apache bRPC version 0 and unconditionally asserts CHECKbuf.IsEmpty on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled curbufsize == 0, reaches these...

CVE-2026-82210

Apache bRPC versions earlier than 1.18.0 are vulnerable to a Remote Denial of Service (DoS) via a reachable assertion (CWE-617 ). The issue occurs in the streaming feature when the server handles FRAME_TYPE_FEEDBACK frames. Specifically, the Stream::SetRemoteConsumed() function contains assertion...

CVE-2026-81755

Apache bRPC versions prior to 1.18.0 are vulnerable to uncontrolled resource consumption in the streaming RPC component. An attacker can exploit the StreamAccept function by sending a single RPC request containing an excessive number of stream identifiers in the stream_settings.extra_stream_ids f...

EUVD-2026-107189

Uncontrolled resource consumption in the streaming RPC component of Apache bRPC version 1.18.0 allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root Cause: In the streaming RPC feature, a...

CVE-2026-81755 Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request

Uncontrolled resource consumption in the streaming RPC component of Apache bRPC version 1.18.0 allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root Cause: In the streaming RPC feature, a...

CVE-2026-79704

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0 ) on all platforms. The root cause is that the Controller::HandleStreamConnection path indexes returned extra_stream_ids using the local stream count without validating the return...

CVE-2026-79704 Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extrastreamid for every additional stream. The response...

EUVD-2026-107187

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extrastreamid for every additional stream. The response...

EUVD-2026-107186

Missing authentication in the streaming RPC path of Apache bRPC version 1.18.0 on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured,...

CVE-2026-78334 Apache bRPC: Missing Authentication for Streaming RPC Frames

Missing authentication in the streaming RPC path of Apache bRPC version 1.18.0 on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured,...

CVE-2026-78334

Apache bRPC versions

CVE-2026-113033

An use after free flaw was found in the Streaming component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=499869964 https://code.google.com/p/chromium/issues/detail?id=113033...

EUVD-2026-105628

Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-105507

Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-120547

Uncontrolled resource consumption in the streaming RPC component of Apache bRPC version 1.18.0 allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root Cause: In the streaming RPC feature, a...

PT-2026-120545

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra stream id for every additional stream. The response...

PT-2026-120557

Enforceable assertion in the streaming feature of Apache bRPC version 0 and unconditionally asserts CHECKbuf.IsEmpty on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled cur buf size == 0, reaches these...

PT-2026-120544

Missing authentication in the streaming RPC path of Apache bRPC version 1.18.0 on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured,...

Linux Distros Unpatched Vulnerability : CVE-2026-113158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-113033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...