Threats tagged 'ghsa-74m8-q5wc-qpjc'

Apache bRPC versions prior to 1.18.0 contain a vulnerability in the streaming RPC component that allows remote attackers to exhaust server memory and cause denial of service. This occurs because the server does not limit the number of streams accepted in a single RPC request, allowing a crafted request to declare an excessive number of streams. The default maximum request body size can carry millions of stream identifiers, each consuming server resources. The issue is fixed in version 1.18.0 by introducing a limit on the number of streams per request.