Resource exhaustion in Apache bRPC - CVE-2026-78066
Published: October 23, 2026
Vulnerability identifier: #VU157352
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-78066
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through disproportionate memory consumption or process termination.
The vulnerability exists due to uncontrolled resource consumption in Apache bRPC's decompression and protocol parsing paths when accepting unbounded decompressed output or unvalidated wire-declared sizes. A remote attacker can send highly compressed bodies or crafted AMF, RTMP, sofa-pbrpc, or mcpack2pb messages to trigger excessive allocations, growing reassembly buffers, or a size underflow that aborts the process.
Affected software
Apache bRPC
How to mitigate CVE-2026-78066
Install security update from vendor's website.
Apache bRPC - update to 1.18.0