Unbounded Memory Accumulation in Apache bRPC on All Platforms

CVE-2026-80463

What is CVE-2026-80463?

Apache bRPC versions prior to 1.18.0 are susceptible to a vulnerability that allows remote attackers to exploit unbounded memory accumulation in the stream message reassembly process. This occurs when malicious entities send an infinite sequence of continuation data frames, leading the server to exhaust its memory and potentially resulting in service downtime. The inherent flaw stems from a lack of constraints on the accumulated size of fragmented messages, allowing an attacker to manipulate the streaming protocol without restrictions. The problem is particularly relevant for services utilizing the built-in streaming protocol with untrusted streams. To mitigate this, it is recommended to either upgrade to bRPC version 1.18.0 or apply the provided patch, which imposes limits on the accumulated payload size.

References