Description
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.

A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service.
Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Denial of Service via Memory Exhaustion
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in Apache bRPC versions earlier than 1.18.0 due to inconsistent enforcement of the configured max_body_size. This weakness allows a remote, unauthenticated peer to send oversized payloads on HTTP/1, HTTP/2, memcache, or couchbase clients. The server can buffer data beyond the intended limit, leading to uncontrolled memory consumption and eventual denial of service.

Affected Systems

Apache Software Foundation's Apache bRPC component is affected. Impacted versions are all releases prior to 1.18.0. The issue arises in both non‑progressive HTTP/1 and HTTP/2 parsing paths, as well as memcache and couchbase response handling.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. The CVSS score is 7.5. However, because a remote client can trigger the over‑buffering without authentication, exploitation requires only network access to the bRPC service. The lack of authentication and the ability to cause memory exhaustion point to a high severity denial‑of‑service risk, especially in environments where bRPC is exposed to public networks.

Generated by OpenCVE AI on October 30, 2026 at 16:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0 or later.
  • If upgrade is not feasible, obtain and apply the patch from PR 3382 which rejects oversized HTTP bodies, returns a 413 for HTTP/1, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses.
  • Restrict direct exposure of the bRPC service to trusted networks, using firewall rules or reverse proxies to limit incoming connections.
  • Continuously monitor memory usage of the bRPC process and set alerts for sudden spikes to detect potential exploitation attempts.

Generated by OpenCVE AI on October 30, 2026 at 16:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.
Title Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
Weaknesses CWE-400
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-30T14:10:48.052Z

Reserved: 2026-07-12T12:38:09.500Z

Link: CVE-2026-61902

cve-icon Vulnrichment

Updated: 2026-10-30T14:10:29.067Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T12:17:22.140

Modified: 2026-10-30T14:17:07.203

Link: CVE-2026-61902

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T16:15:14Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption