Denial of Service Vulnerability in Apache bRPC Streaming RPC Component

CVE-2026-81755

What is CVE-2026-81755?

The streaming RPC feature in Apache bRPC prior to version 1.18.0 is vulnerable to uncontrolled resource consumption, allowing remote attackers to deplete server memory and trigger a denial of service. An attacker can exploit this by sending a malicious RPC request with a high number of stream identifiers, significantly overloading the server with numerous response streams. Each stream consumes valuable server resources, and the lack of restrictions on the number of streams leads to potential service unavailability. Administrators are advised to upgrade to version 1.18.0 or apply a specific patch that enforces limits on stream requests.

References