Resource Exhaustion Vulnerability in Apache bRPC on Various Platforms

CVE-2026-78066

What is CVE-2026-78066?

A resource exhaustion issue exists in Apache bRPC prior to version 1.18.0 across all platforms. This vulnerability arises from several parsers that fail to impose limits on sizes declared by clients or on decompressed data outputs. Attackers can exploit this weakness to induce excessive memory usage, potentially causing the service to crash. Key factors include unbounded output limits in gzip/zlib/snappy decompressors, improper memory allocation in AMF string readers, and vulnerabilities in handling RTMP chunk headers and other message types. To mitigate this vulnerability, users are advised to upgrade to bRPC version 1.18.0 or apply a security patch available in the provided advisory.

References