Threats tagged 'ghsa-qvxp-6v5r-47h4'

Apache bRPC versions prior to 1.18.0 contain multiple resource exhaustion vulnerabilities in parsers handling wire-controlled input. These parsers do not enforce limits on client-declared sizes or decompressed output, allowing attackers to cause excessive memory consumption and crash the service process. The issue affects gzip/zlib/snappy decompressors, AMF string readers, RTMP chunk headers, sofa-pbrpc parser, and mcpack2pb message handling. The vulnerability is fixed in version 1.18.0, which enforces size limits and rejects requests exceeding configured thresholds.