CVE-2026-80463

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to exhaust the memory of a server (denial of service) by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds every single data frame by max_body_size, but a fragmented stream message accumulates continuation frames into one buffer (_pending_buf) without any limit on the accumulated size. A malicious peer that can open a stream can therefore keep sending continuation frames to make the receiver accumulate an arbitrarily large in-memory message. Since the default flow-control settings (socket_max_streams_unconsumed_bytes=0) do not throttle the sending rate, the receiver's memory grows until the process runs out of memory and crashes or becomes unavailable. Affected Scenarios: Services that accept streams from untrusted clients (for example using brpc::StreamAccept or brpc::StreamCreate with the built-in streaming protocol) are affected. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3489 Note: The fix limits the accumulated payload of a fragmented stream message to max_body_size (default 64MB). When the accumulated payload exceeds the limit, the pending fragments are released and the stream is closed with error EMSGSIZE. After applying the fix, legitimate fragmented stream messages larger than max_body_size will be rejected; you can adjust the gflag max_body_size to change the limit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-80463

EUVD

EUVD-2026-107188

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is a denial-of-service vulnerability in Apache bRPC versions before 1.18.0. It occurs when a remote attacker sends endless continuation data frames in a stream message. The receiver accumulates these frames without size limits, causing unbounded memory growth until the server crashes or becomes unavailable.

Detection Guidance

To detect unbounded memory accumulation in Apache bRPC due to CVE-2026-80463, monitor memory usage of bRPC processes and network traffic patterns. Check for processes consuming excessive memory unexpectedly. Use system monitoring tools like top, htop, or ps to observe memory usage spikes in bRPC servers. Inspect network logs for continuous stream data frames from untrusted clients.

Impact Analysis

If you run a service using Apache bRPC that accepts streams from untrusted clients, attackers could exploit this to crash your server by consuming all available memory. This would make your service unavailable until restarted.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service unavailability due to memory exhaustion. GDPR requires data processing systems to maintain availability, while HIPAA mandates reliable access to protected health information. A denial of service could violate these requirements.

Mitigation Strategies

Upgrade bRPC to version 1.18.0 or later to address the vulnerability.
Apply the patch from https://github.com/apache/brpc/pull/3489 if upgrading is not immediately possible.
Monitor memory usage on systems running bRPC services that accept streams from untrusted clients.

Hi! I’m here to help you understand CVE-2026-80463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...