Database/AI/ML frameworks & serving
Apache bRPC: data race between TCP fd and RDMA queue-pair parsing crashes the server
Impact
A remote, unauthenticated client that completes the RDMA handshake can then send bytes on the TCP fd while RDMA completion-queue events are being processed. The TCP input stream and the RDMA QP input stream share Socket::_read_buf, preferred_index and parsing_context with no synchronization, so the parser state and input buffer get corrupted and the server process dies. bRPC with RDMA enabled is a common transport for internal RPC between training and inference services on RDMA-capable GPU nodes, so this is a remote crash of a fleet service reachable over the same fabric that carries tenant traffic. Availability only - no disclosure or write primitive is described. Builds without BRPC_WITH_RDMA are unaffected.
Who can reach it
Any client that can open a connection to an RDMA-enabled bRPC server and complete the handshake. No authentication needed.
What to do
Upgrade to Apache bRPC 1.18.0 or apply the patch in apache/brpc PR 3505, then rebuild and restart the affected services. Restarting an RPC daemon is a rolling, per-process action and does not require draining or rebooting the node. Deployments built without RDMA support need no action.
References
Related entries
- BentoML 1.3.9 (bundled Gradio app, /login endpoint): The /login endpoint of the integrated Gradio app processes eachNCVD-2025-016-bentoml-1-3-9-bundled-gradio-app · BentoML 1.3.9 (bundled Gradio app, /login endpoint)High
- UpTrain: authenticated remote code execution via the checks and metadata parameters on /create_projectCVE-2025-27770 · UpTrain dashboard backend (/create_project endpoint)High
- UpTrain: authenticated remote code execution via the checks and metadata parameters on /add_promptsCVE-2025-27771 · UpTrain dashboard backend (/add_prompts endpoint)High
- UpTrain: authenticated remote code execution via the checks and metadata parameters on /new_runCVE-2025-27772 · UpTrain dashboard backend (/new_run endpoint)High
- joblib: Arbitrary code execution via `eval` on the `pre_dispatch` flag in `Parallel()`CVE-2022-21797 · joblibHigh
- Gradio: Lack of path filteringCVE-2023-34239 · GradioHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.