Threats tagged 'ghsa-3hm8-f7vm-2c3r'

Apache bRPC versions before 1.18.0 have a vulnerability where the configured max_body_size limit is not consistently enforced in certain HTTP and response parsing scenarios. This allows a remote unauthenticated attacker to cause memory exhaustion by sending oversized message data, leading to denial of service. The issue is fixed in version 1.18.0, which properly rejects oversized HTTP bodies and responses.