Description
Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.

Root Cause:
1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g. 64 MiB) can decompress to tens of GiB.
2) The AMF string readers allocate the declared length before the bytes are actually available.
3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.
4) The sofa-pbrpc parser does not bound meta_size.
5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.

Affected Scenarios:
Any bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.

How to Fix:(Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue.

2. Apply this patch: https://github.com/apache/brpc/pull/3476

Note:
After the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Resource Exhaustion (Denial of Service)
Action: Patch
AI Analysis

Impact

Apache bRPC before version 1.18.0 accepts wire‑controlled sizes without limits. When a client provides compressed payloads or messages that declare very large or unbounded lengths, the service decompresses or allocates memory proportional to those values, exhausting system RAM and ultimately crashing the process. This weakness lies in uncontrolled resource consumption (CWE‑770). The CVSS base score assigned is 7.5, indicating high severity.

Affected Systems

This vulnerability affects all Apache bRPC instances older than 1.18.0, regardless of operating system. Any service that exposes bRPC endpoints to external clients, especially those handling gzip, zlib, or snappy‑compressed bodies, RTMP, sofa‑pbrpc, or mcpack2pb messages, is exposed.

Risk and Exploitability

Because the server parses untrusted input without boundary checks, a remote attacker can trigger memory exhaustion against any reachable bRPC service. The CVSS base score is 7.5 and the EPSS score is <1%, indicating a low but non‑zero exploitation probability. The issue is not listed in the CISA KEV catalog, suggesting no known public exploitation yet, but the risk warrants prompt action.

Generated by OpenCVE AI on October 30, 2026 at 18:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to version 1.18.0 or later.
  • If an upgrade cannot be applied immediately, install the security patch from the pull request https://github.com/apache/brpc/pull/3476.
  • After applying a fix, configure the maximum decompressed body size (e.g., by setting -max_decompressed_body_size or max_body_size) only for workloads that legitimately require larger payloads, and monitor resource usage.

Generated by OpenCVE AI on October 30, 2026 at 18:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g. 64 MiB) can decompress to tens of GiB. 2) The AMF string readers allocate the declared length before the bytes are actually available. 3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing. 4) The sofa-pbrpc parser does not bound meta_size. 5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process. Affected Scenarios: Any bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients. How to Fix:(Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3476 Note: After the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).
Title Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
Weaknesses CWE-770
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-30T16:59:10.006Z

Reserved: 2026-08-22T11:46:39.347Z

Link: CVE-2026-78066

cve-icon Vulnrichment

Updated: 2026-10-30T16:58:44.127Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T12:17:23.527

Modified: 2026-10-30T17:17:29.110

Link: CVE-2026-78066

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T19:00:17Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling