Description
Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams.

Root Cause:
In the streaming RPC feature, a client can declare multiple streams in one RPC request by putting extra stream identifiers into the repeated field `stream_settings.extra_stream_ids` of the RPC meta. On the server side, `StreamAccept` creates one response stream for every stream identifier declared by the request, without limiting the number of streams accepted in a single RPC. The request body size is only bounded by `max_body_size` (default 64MB), which is enough to carry millions of stream identifiers. Each accepted stream allocates its own bthread execution queue and associated resources, so a single crafted request can make the server create a huge number of streams and exhaust memory, leading to denial of service.

Affected Scenarios:
Use a bRPC server that serves streaming RPC and calls `StreamAccept` to accept streams from untrusted clients.

How to Fix:
(Choose one of the following options) 
1. Upgrade bRPC to the 1.18.0 version.
2. Apply this patch: https://github.com/apache/brpc/pull/3493


Note:
The fix adds a new gflag `stream_max_streams_per_request` with a default value of 64. Requests declaring more streams than the limit are rejected before any response stream is created. Applications that legitimately need to accept more than 64 streams in one RPC must raise this flag; otherwise such requests will fail after applying the fix.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability lies in the streaming RPC component of Apache bRPC, where a client can include an unchecked count of stream identifiers in the request meta field. Because each declared stream creates its own execution queue and consumes memory, an attacker can submit a single request with millions of streams, exhausting the server's memory and causing a denial of service. The flaw is a classic uncontrolled resource consumption issue, classified as CWE‑400.

Affected Systems

Any deployment of Apache bRPC earlier than version 1.18.0 that exposes streaming RPC endpoints and accepts stream declarations from untrusted clients is affected. This includes all server builds of the bRPC library that install the default settings for stream handling.

Risk and Exploitability

The CVSS score is 7.5, and the EPSS score is <1%, indicating a high severity but low exploitation probability, so an exact quantitative risk cannot be stated. However, the ability to trigger a memory exhaustion DoS from a remote attacker by sending a crafted request, combined with the lack of rate limiting, makes the risk significant for exposed services. The vulnerability is not listed in CISA's KEV catalog, but the potential to disrupt availability remains high if the service is critical.

Generated by OpenCVE AI on October 30, 2026 at 16:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Apache bRPC 1.18.0 or later, which introduces a stream limit and rejects excess streams.
  • If an upgrade cannot be performed immediately, apply the patch from the GitHub pull request to add the same stream limit.
  • After applying the fix, set the gflag stream_max_streams_per_request to the default 64 or a stricter value to guard against oversized requests.
  • For applications that legitimately require more than 64 streams, raise the flag but monitor memory usage closely.
  • Consider reducing the maximum request body size (max_body_size) below 64 MB to limit the volume of stream identifiers that can be sent.

Generated by OpenCVE AI on October 30, 2026 at 16:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root Cause: In the streaming RPC feature, a client can declare multiple streams in one RPC request by putting extra stream identifiers into the repeated field `stream_settings.extra_stream_ids` of the RPC meta. On the server side, `StreamAccept` creates one response stream for every stream identifier declared by the request, without limiting the number of streams accepted in a single RPC. The request body size is only bounded by `max_body_size` (default 64MB), which is enough to carry millions of stream identifiers. Each accepted stream allocates its own bthread execution queue and associated resources, so a single crafted request can make the server create a huge number of streams and exhaust memory, leading to denial of service. Affected Scenarios: Use a bRPC server that serves streaming RPC and calls `StreamAccept` to accept streams from untrusted clients. How to Fix: (Choose one of the following options)  1. Upgrade bRPC to the 1.18.0 version. 2. Apply this patch: https://github.com/apache/brpc/pull/3493 Note: The fix adds a new gflag `stream_max_streams_per_request` with a default value of 64. Requests declaring more streams than the limit are rejected before any response stream is created. Applications that legitimately need to accept more than 64 streams in one RPC must raise this flag; otherwise such requests will fail after applying the fix.
Title Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
Weaknesses CWE-400
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-30T14:22:06.684Z

Reserved: 2026-08-27T12:21:32.957Z

Link: CVE-2026-81755

cve-icon Vulnrichment

Updated: 2026-10-30T14:20:46.423Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T12:17:24.283

Modified: 2026-10-30T15:16:55.300

Link: CVE-2026-81755

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T17:00:20Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption