Memory Exhaustion Vulnerability in Apache bRPC Affects Multiple Versions

CVE-2026-61902

What is CVE-2026-61902?

Apache bRPC versions prior to 1.18.0 do not reliably enforce the max_body_size limit in certain parsing scenarios, allowing remote unauthenticated peers to overflow buffer limits. This may cause memory exhaustion, resulting in a denial of service. Users are advised to upgrade to version 1.18.0 or apply the relevant patch to ensure proper rejection of oversized buffered HTTP bodies and prevent potential service disruptions.

References