CVE-2026-61902: CWE-400 Uncontrolled Resource Consumption in Apache Software Foundation Apache bRPC

Apache bRPC prior to version 1.18.0 does not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing, as well as in memcache and couchbase response parsing. This flaw allows a remote unauthenticated peer to cause the affected process to buffer message data beyond the configured limit, leading to uncontrolled resource consumption (memory exhaustion) and denial of service. The fix introduced in version 1.18.0 rejects oversized buffered HTTP bodies by returning HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses based on their declared lengths. Progressive HTTP reading remains supported as it uses bounded buffering.

A remote unauthenticated attacker can exploit this vulnerability to cause memory exhaustion on the affected system, resulting in denial of service. This impacts availability by potentially crashing or severely degrading the performance of the Apache bRPC service.

Users should upgrade Apache bRPC to version 1.18.0 or later, which includes an official fix that enforces the max_body_size limit correctly. The patch rejects oversized HTTP bodies and responses, preventing memory exhaustion. No other mitigation is indicated by the vendor advisory.