CVE-2026-78066

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g. 64 MiB) can decompress to tens of GiB. 2) The AMF string readers allocate the declared length before the bytes are actually available. 3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing. 4) The sofa-pbrpc parser does not bound meta_size. 5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process. Affected Scenarios: Any bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients. How to Fix:(Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3476 Note: After the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-78066

EUVD

EUVD-2026-107185

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a resource exhaustion issue in Apache bRPC versions before 1.18.0. Attackers can exploit it by sending specially crafted input that causes excessive memory usage, leading to process crashes. The issue stems from multiple parsers not enforcing limits on decompressed output sizes or declared lengths, allowing disproportionate memory consumption.

Impact Analysis

If you run a bRPC service accepting compressed or RTMP/mcpack2pb messages from untrusted clients, attackers could crash your service by sending maliciously large inputs. This could lead to denial-of-service, disrupting legitimate users and services relying on your system.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting server resources, potentially disrupting services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade bRPC to version 1.18.0 or later to address the resource exhaustion issues.
Apply the patch from https://github.com/apache/brpc/pull/3476 if upgrading is not immediately possible.
Monitor for unusually high memory usage in bRPC services, especially those handling compressed or RTMP traffic.
Restrict untrusted client access to bRPC services until mitigation is applied.

Hi! I’m here to help you understand CVE-2026-78066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...