{"id":"CVE-2026-61902","kind":"vulnerability","aliases":["CVE-2026-61902"],"related":[],"title":"Apache bRPC: body size limit not enforced, enabling memory exhaustion denial of service","description":"Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.\n\nA remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. \nUsers should upgrade to 1.18.0 or apply the patch from PR  https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.","summary":"Apache bRPC before 1.18.0 does not consistently enforce the configured max_body_size limit when parsing non-progressive HTTP/1 and HTTP/2 requests and memcache and couchbase responses. A remote unauthenticated peer can make the process buffer data beyond that limit, exhausting memory and causing a denial of service.","severity":"unknown","cvss":null,"epss":0.00158,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","memory-exhaustion","package","rpc","self-hosted"],"not_affected_if":["no-network-exposure","version-1.18.0-or-later"],"how_to_check":"- Check the bRPC version in use; affected versions are those before `1.18.0`.\n- Look for `max_body_size` in the server configuration and for non-progressive HTTP reading or memcache/couchbase client use.","fix":"- Upgrade bRPC to `1.18.0` or later.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3382.","status":"open","published_at":"2026-10-21T12:17:22+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:44+00:00","updated_at":"2026-10-25T05:02:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bRPC to `1.18.0` or later.\n- Alternatively, apply the patch from https://github.com/apache/brpc/pull/3382.","reach":"internet","title":"Apache bRPC: body size limit not enforced, enabling memory exhaustion denial of service","impact":"low","summary":"Apache bRPC before 1.18.0 does not consistently enforce the configured max_body_size limit when parsing non-progressive HTTP/1 and HTTP/2 requests and memcache and couchbase responses. A remote unauthenticated peer can make the process buffer data beyond that limit, exhausting memory and causing a denial of service.","category":"package","nicknames":[],"who_cares":["c++","rpc","self-hosted","memory-exhaustion"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote peer exhausts process memory, causing denial of service.","analyst_note":"","how_to_check":"- Check the bRPC version in use; affected versions are those before `1.18.0`.\n- Look for `max_body_size` in the server configuration and for non-progressive HTTP reading or memcache/couchbase client use.","needs_analyst":false,"not_affected_if":["version-1.18.0-or-later","no-network-exposure"],"who_is_affected":"Services built on Apache bRPC before 1.18.0 that accept HTTP/1 or HTTP/2 traffic from untrusted peers, or that talk to memcache or couchbase backends, are exposed. Progressive HTTP reading is handled by bounded buffering and is not the concern here. Teams on 1.18.0 or later, or with no network-reachable bRPC listener, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":3532,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-61902':16A,19A '/apache/brpc/pull/3382':148C '1.18.0':32B,82C,139C '413':158C 'affect':115C 'apach':1A,29B,78C 'appli':141C 'beyond':67B,121C 'bodi':3A,40B,90C,155C 'bound':185C 'brpc':2A,30B,79C 'buffer':65B,118C,153C,186C 'c':20B 'caus':73B,113C 'configur':38B,88C,123C 'consist':35B,85C 'couchbas':55B,105C,171C 'cve':14A,17A 'data':66B,120C 'declar':175C 'denial':11A,75B,132C 'enabl':8A 'enforc':7A,36B,86C 'exhaust':10A,23B,70B,130C 'fix':150C 'github.com':147C 'github.com/apache/brpc/pull/3382':146C 'host':28B 'http':154C,157C,178C 'http/1':48B,97C,160C 'http/2':50B,99C,164C 'lead':127C 'length':176C 'limit':5A,42B,69B,92C,124C 'make':62B 'max':39B,89C 'may':126C 'memcach':53B,103C,169C 'memori':9A,22B,71B,129C 'memory-exhaust':21B 'messag':119C 'non':46B,95C 'non-progress':45B,94C 'overs':152C,163C,168C 'packag':24B 'pars':44B,100C,107C 'patch':143C 'peer':60B,111C 'pr':145C 'process':64B,116C 'progress':47B,96C,177C 'read':179C 'reject':151C,167C 'remain':180C 'remot':58B,109C 'request':51B,161C 'reset':162C 'respons':56B,106C,172C 'return':156C 'rpc':25B 'self':27B 'self-host':26B 'servic':13A,77B,134C 'size':4A,41B,91C 'stream':165C 'support':181C 'unauthent':59B,110C 'upgrad':137C 'use':184C 'user':135C 'version':80C","nicknames":[],"mitigations":[],"who_affected":"Services built on Apache bRPC before 1.18.0 that accept HTTP/1 or HTTP/2 traffic from untrusted peers, or that talk to memcache or couchbase backends, are exposed. Progressive HTTP reading is handled by bounded buffering and is not the concern here. Teams on 1.18.0 or later, or with no network-reachable bRPC listener, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61902","severity":null,"published_at":"2026-10-21T12:17:22+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-61902","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61902","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}