CVE-2026-80463: CWE-770 Allocation of Resources Without Limits or Throttling in Apache Software Foundation Apache bRPC

CVE-2026-80463 is a resource exhaustion vulnerability in Apache bRPC versions before 1.18.0. The flaw is due to unbounded accumulation of continuation frames in the stream message reassembly buffer (_pending_buf), which lacks limits on size. Attackers able to open a stream can send an endless sequence of continuation data frames, causing the server's memory to grow until exhaustion, resulting in denial of service. The default flow-control setting (socket_max_streams_unconsumed_bytes=0) does not throttle the sending rate, enabling this attack. The vulnerability impacts services accepting streams from untrusted clients via brpc::StreamAccept or brpc::StreamCreate. The fix in version 1.18.0 enforces a limit on the accumulated payload equal to max_body_size (default 64MB), releasing pending fragments and closing the stream with EMSGSIZE error if exceeded. This prevents unbounded memory growth.

Remote attackers can cause a denial of service by exhausting server memory through sending an endless sequence of continuation data frames in a stream. This leads to server crashes or unavailability. The vulnerability affects all platforms running Apache bRPC versions prior to 1.18.0 when accepting streams from untrusted clients.

Upgrade Apache bRPC to version 1.18.0 or later, which includes an official fix limiting the accumulated payload size in fragmented stream messages. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3489. After applying the fix, streams exceeding the max_body_size limit (default 64MB) will be closed with an error, preventing memory exhaustion. Adjust the max_body_size gflag if larger legitimate fragmented messages are required.