Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
Summary
| CVE | CVE-2026-61902 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-21 12:17:22 UTC |
| Updated | 2026-10-26 21:10:00 UTC |
| Description | Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering. |
Risk And Classification
EPSS: 0.001580000 probability, percentile 0.048840000 (date 2026-10-26)
Problem Types: CWE-400 | CWE-400 CWE-400 Uncontrolled Resource Consumption
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache BRPC | affected 1.18.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb | [email protected] | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: BeaCox (en)
There are currently no legacy QID mappings associated with this CVE.