{"api_version":"1","generated_at":"2026-10-26T10:17:16+00:00","cve":"CVE-2026-78066","urls":{"html":"https://cve.report/CVE-2026-78066","api":"https://cve.report/api/cve/CVE-2026-78066.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-78066","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-78066"},"summary":{"title":"Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes","description":"Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.\n\nRoot Cause:\n1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g. 64 MiB) can decompress to tens of GiB.\n2) The AMF string readers allocate the declared length before the bytes are actually available.\n3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.\n4) The sofa-pbrpc parser does not bound meta_size.\n5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.\n\nAffected Scenarios:\nAny bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.\n\nHow to Fix:(Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n\n2. Apply this patch: https://github.com/apache/brpc/pull/3476\n\nNote:\nAfter the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).","state":"PUBLISHED","assigner":"apache","published_at":"2026-10-21 12:17:23","updated_at":"2026-10-22 16:56:37"},"problem_types":["CWE-770","CWE-770 CWE-770 Allocation of Resources Without Limits or Throttling"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb","name":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78066","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78066","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache bRPC","version":"affected 1.18.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Claude","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"78066","cve":"CVE-2026-78066","epss":"0.001640000","percentile":"0.053580000","score_date":"2026-10-22","updated_at":"2026-10-23 00:07:29"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://github.com","defaultStatus":"unaffected","packageName":"apache/brpc","packageURL":"pkg:github/apache/brpc","product":"Apache bRPC","vendor":"Apache Software Foundation","versions":[{"lessThan":"1.18.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Claude"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Resource exhaustion in Apache bRPC (version &lt; 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.<br><br>Root Cause:<br>1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g.&nbsp;64&nbsp;MiB) can decompress to tens of GiB.<br>2) The AMF string readers allocate the declared length before the bytes are actually available.<br>3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.<br>4) The sofa-pbrpc parser does not bound meta_size.<br>5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.<br><br>Affected Scenarios:<br>Any bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.<br><br>How to Fix:<span>(Choose one of the following options)&nbsp;</span><div><span>1. Upgrade bRPC to version 1.18.0, which fixes this issue.</span></div><div><span>2. Apply this patch:&nbsp;</span>https://github.com/apache/brpc/pull/3476<br><br>Note:<br>After the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).</div>"}],"value":"Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.\n\nRoot Cause:\n1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g. 64 MiB) can decompress to tens of GiB.\n2) The AMF string readers allocate the declared length before the bytes are actually available.\n3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.\n4) The sofa-pbrpc parser does not bound meta_size.\n5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.\n\nAffected Scenarios:\nAny bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.\n\nHow to Fix:(Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n\n2. Apply this patch: https://github.com/apache/brpc/pull/3476\n\nNote:\nAfter the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size)."}],"metrics":[{"other":{"content":{"text":"high"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"CWE-770 Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-21T11:53:42.058Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"}],"source":{"discovery":"EXTERNAL"},"title":"Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-78066","datePublished":"2026-10-21T11:53:42.058Z","dateReserved":"2026-08-22T11:46:39.347Z","dateUpdated":"2026-10-21T11:53:42.058Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-21 12:17:23","lastModifiedDate":"2026-10-22 16:56:37","problem_types":["CWE-770","CWE-770 CWE-770 Allocation of Resources Without Limits or Throttling"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"78066","Ordinal":"1","Title":"Apache bRPC: Resource Exhaustion via Unbounded Decompression and","CVE":"CVE-2026-78066","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"78066","Ordinal":"1","NoteData":"Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.\n\nRoot Cause:\n1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g. 64 MiB) can decompress to tens of GiB.\n2) The AMF string readers allocate the declared length before the bytes are actually available.\n3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.\n4) The sofa-pbrpc parser does not bound meta_size.\n5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.\n\nAffected Scenarios:\nAny bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.\n\nHow to Fix:(Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n\n2. Apply this patch: https://github.com/apache/brpc/pull/3476\n\nNote:\nAfter the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).","Type":"Description","Title":"Apache bRPC: Resource Exhaustion via Unbounded Decompression and"}]}}}