Allocation of Resources Without Limits or Throttling in Apache bRPC - CVE-2026-80463
Published: October 23, 2026
Vulnerability identifier: #VU157355
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80463
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by exhausting server memory.
The vulnerability exists due to uncontrolled memory allocation in Apache bRPC's stream message reassembly path when continuation frames accumulate in _pending_buf without an aggregate size limit. A remote attacker can open a stream and send an endless sequence of continuation data frames to grow the receiver's buffered message until the process crashes or becomes unavailable.
Affected software
Apache bRPC
How to mitigate CVE-2026-80463
Install security update from vendor's website.
Apache bRPC - update to 1.18.0