---
id: "CVE-2026-78066"
kind: "vulnerability"
aliases: ["CVE-2026-78066"]
title: "Apache bRPC: unbounded decompression and parsing lets remote clients exhaust memory"
severity: "unknown"
cvss: null
epss: 0.00164
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-brpc", "c++", "package", "rpc-services", "self-hosted"]
not_affected_if: ["default-config", "internal-only"]
published_at: "2026-10-21T12:17:23+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T05:02:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78066", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-78066", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache bRPC: unbounded decompression and parsing lets remote clients exhaust memory

Apache bRPC versions before 1.18.0 accept gzip, zlib and snappy bodies with no limit on decompressed size, and several parsers (AMF, RTMP, sofa-pbrpc, mcpack2pb) trust wire-declared sizes. A remote client can drive memory use far beyond the body cap or crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run the bRPC version check in the service's build or lockfile and confirm whether it is below `1.18.0`
- Look for services that accept gzip, zlib or snappy compressed request bodies, or the rtmp, sofa-pbrpc or mcpack2pb protocols, from untrusted clients

## Fix

- Upgrade bRPC to `1.18.0`
- Or apply the patch from https://github.com/apache/brpc/pull/3476
- If larger legitimate decompressed bodies are needed after the fix, raise `-max_decompressed_body_size` or `max_body_size` deliberately

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78066
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-78066

## From the sources

Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.

Root Cause:
1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g. 64 MiB) can decompress to tens of GiB.
2) The AMF string readers allocate the declared length before the bytes are actually available.
3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.
4) The sofa-pbrpc parser does not bound meta_size.
5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.

Affected Scenarios:
Any bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.

How to Fix:(Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue.

2. Apply this patch: https://github.com/apache/brpc/pull/3476

Note:
After the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_