CVE-2026-78066: CWE-770 Allocation of Resources Without Limits or Throttling in Apache Software Foundation Apache bRPC

Apache bRPC before version 1.18.0 contains multiple resource exhaustion flaws due to lack of limits on input sizes and decompressed output. Specifically, decompressors for gzip, zlib, and snappy do not enforce output size limits, allowing a compressed body within size limits to decompress to tens of gigabytes. AMF string readers allocate memory based on declared lengths before data availability. RTMP chunk headers can re-declare message lengths without bounds, causing unbounded buffer growth. The sofa-pbrpc parser does not limit meta_size, and mcpack2pb trusts wire-declared item counts, which can cause buffer underflows and process aborts. These issues can be exploited by attackers sending crafted messages to cause disproportionate memory use and crash the process. The vulnerability is addressed in Apache bRPC 1.18.0 by enforcing limits and rejecting requests exceeding configured thresholds.

Attackers can exploit this vulnerability to cause resource exhaustion on affected Apache bRPC services by sending specially crafted compressed or protocol messages. This can lead to excessive memory consumption and process crashes, resulting in denial of service. The vulnerability affects any bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.

Upgrade Apache bRPC to version 1.18.0, which includes fixes that enforce limits on decompressed sizes, message lengths, and declared counts. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3476. After applying the fix, requests exceeding the new limits are rejected. Operators requiring larger limits can adjust the corresponding flags (-max_decompressed_body_size, max_body_size) as needed.