CVE-2026-79704 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for systems using Apache bRPC, particularly those in versions 1.11.0 through 1.17.0, should assess exposure and potential impact. This includes teams managing RPC clients and servers, as well as security teams focused on vulnerability management and mitigation.

Why it matters

CVE-2026-79704 is an out-of-bounds read vulnerability in Apache bRPC's multi-stream RPC response handling. Defenders should verify exposure, assess impact, and prioritize mitigation for systems using affected versions (1.11.0-1.17.0) to prevent potential denial of service or memory leaks.

• Potential denial of service due to client process crashes.
• Possible memory leaks due to unintended memory contents being processed.
• Verification of exposure and impact is necessary for systems using affected Apache bRPC versions.
• Prioritization of patching or mitigation strategies for vulnerable systems.

Technical summary

The vulnerability exists in the streaming RPC client of Apache bRPC, specifically in versions 1.11.0 through 1.17.0. A client creating multiple streams in a single RPC expects the server response to carry exactly one extra_stream_id for every additional stream. However, the response handling path indexes the returned identifiers using the locally created stream count without validating the size of the returned list. This allows a malicious or compromised server (or an on-path attacker) to trigger an out-of-bounds read in the client by returning a malformed StreamSettings response with fewer extra_stream_ids than expected.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using affected Apache bRPC versions.

Recommended defensive actions

• Verify if systems using Apache bRPC are exposed to the vulnerability by checking if they use affected versions (1.11.0 through 1.17.0).
• Assess potential impact and prioritize patching or mitigating the vulnerability.
• Monitor for potential denial of service or memory leak consequences.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Apache bRPC versions 1.11.0 through 1.17.0 and the potential for denial of service or memory leaks. The vulnerability is triggered by a malformed StreamSettings response with fewer extra_stream_ids than expected, allowing an attacker to cause an out-of-bounds read. Defenders should verify exposure and assess potential impact, focusing on systems using affected Apache bRPC versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.