CVE-2026-81755: CWE-400 Uncontrolled Resource Consumption in Apache Software Foundation Apache bRPC

Apache bRPC versions before 1.18.0 have a vulnerability in the streaming RPC feature where a client can declare multiple streams in one RPC request via the repeated field `stream_settings.extra_stream_ids`. The server's `StreamAccept` function creates a response stream for each declared stream without limiting the number of streams per request. Since the request body size can be up to 64MB, an attacker can include millions of stream identifiers, causing the server to allocate a large number of bthread execution queues and associated resources. This leads to uncontrolled resource consumption and denial of service. The fix in version 1.18.0 adds a gflag `stream_max_streams_per_request` defaulting to 64, rejecting requests that exceed this limit before any streams are created. Applications requiring more than 64 streams per request must explicitly raise this limit.

A remote attacker can cause a denial of service by exhausting server memory and resources through a single crafted RPC request that declares an excessive number of streams. This impacts availability of the affected Apache bRPC server instances that serve streaming RPC and accept streams from untrusted clients.

Upgrade Apache bRPC to version 1.18.0 or later, which includes an official fix that limits the number of streams accepted per RPC request. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3493. The fix introduces a configurable limit (`stream_max_streams_per_request`) defaulting to 64 streams per request; requests exceeding this limit are rejected before resource allocation. Applications needing more than 64 streams per request should adjust this flag accordingly. No other mitigation is indicated by the vendor advisory.