Is CVE-2026-79704 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79704 being exploited in the wild.

How severe is CVE-2026-79704?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Apache Brpc 1.11.0 through 1.17.0.

Is there a fix for CVE-2026-79704?

Yes: fixed in bRPC 1.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79704 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-79704?

Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79704: Apache bRPC out-of-bounds read in streaming RPC client

CVE-2026-79704 · Severity: info · Published 2026-10-21

Apache bRPC is a remote procedure call framework used by applications to communicate over networks. A vulnerability in the client code that handles multiple concurrent streams allows a malicious server to crash the client or read sensitive memory contents by sending a specially crafted response. This affects clients connecting to untrusted servers or networks where traffic can be intercepted.

Technologies: Apache Brpc. Vendors: Apache.

Quick answers

Is CVE-2026-79704 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79704 being exploited in the wild.
How severe is CVE-2026-79704?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Brpc 1.11.0 through 1.17.0.
Is there a fix for CVE-2026-79704?: Yes: fixed in bRPC 1.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79704 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-79704?: Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: bRPC 1.18.0

Technical details

An out-of-bounds read vulnerability exists in the Controller::HandleStreamConnection path when a bRPC client creates multiple streams in a single RPC. The client fails to validate the size of the extra_stream_ids list returned by the server before indexing into it, allowing a malicious or compromised server (or on-path attacker) to trigger out-of-bounds memory access. This can result in denial of service via client crash or information disclosure through unintended memory leaks.

Affected products

Apache bRPC 1.11.0 through 1.17.0

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.