Is CVE-2026-90484 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90484 being exploited in the wild.

How severe is CVE-2026-90484?

Informational severity, published 21 October 2026.

Is there a fix for CVE-2026-90484?

Yes: fixed in bRPC 1.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-90484 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90484?

Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90484: Apache bRPC MySQL client null pointer dereference

CVE-2026-90484 · Severity: info · Published 2026-10-21

Apache bRPC is a service framework used by applications to communicate with MySQL databases. A malicious or compromised MySQL server can send a specially crafted response packet that causes the bRPC client to crash, resulting in denial of service to applications relying on that database connection.

Technologies: Apache Brpc. Vendors: Apache.

Quick answers

Is CVE-2026-90484 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90484 being exploited in the wild.
How severe is CVE-2026-90484?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Brpc before 1.18.0.
Is there a fix for CVE-2026-90484?: Yes: fixed in bRPC 1.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90484 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90484?: Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: bRPC 1.18.0

Technical details

The MySQL client response parser in bRPC fails to reject zero-payload-length response packets before attempting to read the response type byte. When buf.fetch(header, 5) returns nullptr for an empty packet, the subsequent read of p[4] dereferences a null pointer, crashing the client. The vulnerability affects both the initial response type determination and the fast-auth code path, and requires a network-adjacent attacker (server or MITM) to send the malicious packet.

Affected products

Apache bRPC before 1.18.0

Timeline

2026-10-21: disclosed: CVE-2026-90484 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.