# CVE-2026-82942: Apache bRPC data race in RDMA transport

Source: https://junglewise.ai/threats/cve-2026-82942-a-data-race-in-the-rdma-transport-of-apache-brpc-versions-1-18-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-82942 · Severity: info · Published 2026-10-21

Apache bRPC is a popular RPC framework used for server-to-server communication. When RDMA transport is enabled, a data race vulnerability allows an unauthenticated remote client to crash the server by sending concurrent messages over TCP and RDMA channels, leading to service outages. Only servers with RDMA explicitly enabled at build and runtime are affected.

Technologies: [Apache Brpc](https://junglewise.ai/threats/technologies/brpc). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82942 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82942 being exploited in the wild.

**How severe is CVE-2026-82942?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Brpc < 1.18.0.

**Is there a fix for CVE-2026-82942?** Yes: fixed in bRPC 1.18.0. Until then: Disable RDMA support by not building with the BRPC_WITH_RDMA flag, or restrict network access to bRPC servers to only trusted clients until the upgrade can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82942 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82942?** Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in bRPC 1.18.0

Disable RDMA support by not building with the BRPC_WITH_RDMA flag, or restrict network access to bRPC servers to only trusted clients until the upgrade can be applied.

## Technical details

A data race exists in the RDMA transport layer where the TCP file descriptor and RDMA completion queue both access shared Socket::_read_buf, preferred_index, and parsing_context without synchronization (CWE-362). An unauthenticated attacker with a completed RDMA handshake can send data on the TCP channel concurrently with RDMA message processing, corrupting the input buffer and parser state. The vulnerability requires RDMA to be enabled at both build time (BRPC_WITH_RDMA flag) and runtime (rdma:// or SOCKET_MODE_RDMA sockets).

## Affected products

- Apache bRPC < 1.18.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://github.com/](https://github.com/)
- [https://github.com/apache/brpc/issues/3479](https://github.com/apache/brpc/issues/3479)

## Related threats

- [Apache bRPC MySQL client null pointer dereference](https://junglewise.ai/threats/cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a)
- [Apache bRPC Discovery naming-service JSON parsing crash](https://junglewise.ai/threats/cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions)
- [brpc Server authentication bypass via internal_port](https://junglewise.ai/threats/cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and)
- [Apache bRPC path traversal and resource exhaustion in builtin services](https://junglewise.ai/threats/cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource)
- [Apache bRPC HTTP request/response smuggling in bundled parser](https://junglewise.ai/threats/cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request)