CVE-2026-61902None▾ SunlitApache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an af…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.
A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.
apache/brpc < 1.18.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78058NoneApache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
CVE-2026-81755NoneApache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
CVE-2026-86147NoneApache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
CVE-2026-56387NoneApache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
CVE-2026-56388NoneApache bRPC: Out-of-Bounds Write in Redis Command Parser
CVE-2026-58064NoneApache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation