{"id":"CVE-2026-78066","kind":"vulnerability","aliases":["CVE-2026-78066"],"related":[],"title":"Apache bRPC: unbounded decompression and parsing lets remote clients exhaust memory","description":"Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.\n\nRoot Cause:\n1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g. 64 MiB) can decompress to tens of GiB.\n2) The AMF string readers allocate the declared length before the bytes are actually available.\n3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.\n4) The sofa-pbrpc parser does not bound meta_size.\n5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.\n\nAffected Scenarios:\nAny bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.\n\nHow to Fix:(Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n\n2. Apply this patch: https://github.com/apache/brpc/pull/3476\n\nNote:\nAfter the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).","summary":"Apache bRPC versions before 1.18.0 accept gzip, zlib and snappy bodies with no limit on decompressed size, and several parsers (AMF, RTMP, sofa-pbrpc, mcpack2pb) trust wire-declared sizes. A remote client can drive memory use far beyond the body cap or crash the process.","severity":"unknown","cvss":null,"epss":0.00164,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-brpc","c++","package","rpc-services","self-hosted"],"not_affected_if":["default-config","internal-only"],"how_to_check":"- Run the bRPC version check in the service's build or lockfile and confirm whether it is below `1.18.0`\n- Look for services that accept gzip, zlib or snappy compressed request bodies, or the rtmp, sofa-pbrpc or mcpack2pb protocols, from untrusted clients","fix":"- Upgrade bRPC to `1.18.0`\n- Or apply the patch from https://github.com/apache/brpc/pull/3476\n- If larger legitimate decompressed bodies are needed after the fix, raise `-max_decompressed_body_size` or `max_body_size` deliberately","status":"open","published_at":"2026-10-21T12:17:23+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:35+00:00","updated_at":"2026-10-25T05:02:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:02:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bRPC to `1.18.0`\n- Or apply the patch from https://github.com/apache/brpc/pull/3476\n- If larger legitimate decompressed bodies are needed after the fix, raise `-max_decompressed_body_size` or `max_body_size` deliberately","reach":"internet","title":"Apache bRPC: unbounded decompression and parsing lets remote clients exhaust memory","impact":"medium","summary":"Apache bRPC versions before 1.18.0 accept gzip, zlib and snappy bodies with no limit on decompressed size, and several parsers (AMF, RTMP, sofa-pbrpc, mcpack2pb) trust wire-declared sizes. A remote client can drive memory use far beyond the body cap or crash the process.","category":"package","nicknames":[],"who_cares":["apache-brpc","c++","self-hosted","rpc-services"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote client crashes the server process or exhausts its memory","analyst_note":"Check the NVD record and PR 3476 to confirm which protocols and default settings are affected and whether a crash versus sustained memory use is the realistic outcome.","how_to_check":"- Run the bRPC version check in the service's build or lockfile and confirm whether it is below `1.18.0`\n- Look for services that accept gzip, zlib or snappy compressed request bodies, or the rtmp, sofa-pbrpc or mcpack2pb protocols, from untrusted clients","needs_analyst":true,"not_affected_if":["default-config","internal-only"],"who_is_affected":"Services built on Apache bRPC below 1.18.0 that accept requests from untrusted clients are exposed, especially when they take compressed bodies or use the rtmp, sofa-pbrpc or mcpack2pb protocols. Services that only accept traffic from trusted internal callers, or that do not use those features, carry lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":3829,"output_tokens":711,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-78066':14A,17A '/apache/brpc/pull/3476':277C '0':225C '1':123C,261C '1.18.0':33B,82C,266C '2':156C,271C '3':171C '4':198C '5':209C '64':148C 'abort':230C 'accept':34B,89C,238C 'actual':169C 'affect':233C 'alloc':161C 'amf':49B,158C 'apach':1A,19B,29B,79C 'apache-brpc':18B 'appli':272C 'attack':109C 'avail':170C 'beyond':68B 'bodi':39B,70B,132C,146C,240C,312C,315C 'bound':94C,190C,206C 'brpc':2A,20B,30B,80C,236C,263C 'buffer':195C,228C 'byte':139C,167C 'c':21B 'cap':71B,144C 'cap-compli':143C 'caus':122C 'check':135C 'choos':255C 'chunk':173C 'client':9A,62B,103C,251C 'compliant':145C 'compress':138C 'control':92C 'correspond':308C 'count':216C,292C 'crash':73B,118C 'cve':12A,15A 'declar':58B,100C,163C,178C,186C,214C,291C 'decompress':4A,44B,106C,151C,284C,311C 'decompressor':126C 'disproportion':114C 'drive':64B,113C 'e.g':147C 'enforc':127C 'exceed':293C 'exhaust':10A,77C 'far':67B 'fix':254C,268C,281C 'flag':309C 'follow':259C 'gib':155C 'github.com':276C 'github.com/apache/brpc/pull/3476':275C 'grow':197C 'gzip':35B 'gzip/zlib/snappy':125C 'gzip/zlib/snappy-compressed':239C 'header':174C 'host':28B 'input':93C 'issu':270C 'item':215C 'kept':196C 'larger':303C 'legitim':301C 'length':164C,181C,187C,288C 'let':7A 'limit':42B,96C,130C,296C 'max':131C,310C,314C 'may':175C 'mcpack':290C 'mcpack2pb':54B,210C,247C 'memori':11A,65B,115C 'messag':180C,248C,287C 'meta':207C 'mib':149C 'mid':183C 'mid-stream':182C 'multipl':86C 'need':302C 'never':189C 'new':295C 'note':278C 'one':256C 'oper':299C 'option':260C 'output':107C,129C 'packag':22B 'pars':6A 'parser':48B,87C,203C 'partial':193C 'patch':274C 'pbrpc':53B,202C,245C 'platform':85C 'process':75B,120C,232C 'rais':306C 're':177C 're-declar':176C 'reader':160C 'reassembl':194C 'reject':298C 'remot':8A,61B 'request':282C 'reserv':218C 'resourc':76C 'root':121C 'rpc':24B 'rpc-servic':23B 'rtmp':50B,172C,242C,286C 'scenario':234C 'self':27B 'self-host':26B 'servic':25B,237C 'sever':47B 'size':45B,59B,99C,133C,208C,223C,229C,285C,313C,316C 'snappi':38B 'sofa':52B,201C,244C 'sofa-pbrpc':51B,200C,243C 'stream':184C 'string':159C,221C 'ten':153C 'trust':55B,211C 'unbound':3A 'underflow':226C 'untrust':250C 'upgrad':262C 'use':66B,111C,116C 'valu':222C,304C 'version':31B,81C,265C 'whose':283C 'wire':57B,91C,213C 'wire-control':90C 'wire-declar':56B,212C 'zlib':36B","nicknames":[],"mitigations":[],"who_affected":"Services built on Apache bRPC below 1.18.0 that accept requests from untrusted clients are exposed, especially when they take compressed bodies or use the rtmp, sofa-pbrpc or mcpack2pb protocols. Services that only accept traffic from trusted internal callers, or that do not use those features, carry lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78066","severity":null,"published_at":"2026-10-21T12:17:23+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-78066","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78066","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}