CVE-2026-78066

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78066", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-22T11:46:39.347Z", "datePublished": "2026-10-21T11:53:42.058Z", "dateUpdated": "2026-10-30T16:59:10.006Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T11:53:42.058Z"}, "title": "Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes", "problemTypes": [{"descriptions": [{"description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "packageURL": "pkg:github/apache/brpc", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://github.com", "packageName": "apache/brpc"}], "descriptions": [{"value": "Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.\n\nRoot Cause:\n1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g.\u00a064\u00a0MiB) can decompress to tens of GiB.\n2) The AMF string readers allocate the declared length before the bytes are actually available.\n3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.\n4) The sofa-pbrpc parser does not bound meta_size.\n5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.\n\nAffected Scenarios:\nAny bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.\n\nHow to Fix:(Choose one of the following options)\u00a01. Upgrade bRPC to version 1.18.0, which fixes this issue.\n\n2. Apply this patch:\u00a0https://github.com/apache/brpc/pull/3476\n\nNote:\nAfter the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Resource exhaustion in Apache bRPC (version &lt; 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.<br><br>Root Cause:<br>1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g.&nbsp;64&nbsp;MiB) can decompress to tens of GiB.<br>2) The AMF string readers allocate the declared length before the bytes are actually available.<br>3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.<br>4) The sofa-pbrpc parser does not bound meta_size.<br>5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.<br><br>Affected Scenarios:<br>Any bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.<br><br>How to Fix:<span>(Choose one of the following options)&nbsp;</span><div><span>1. Upgrade bRPC to version 1.18.0, which fixes this issue.</span></div><div><span>2. Apply this patch:&nbsp;</span>https://github.com/apache/brpc/pull/3476<br><br>Note:<br>After the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).</div>"}]}], "references": [{"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "high"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Claude", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T16:59:01.033553Z", "id": "CVE-2026-78066", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:59:10.006Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78066", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-22T11:46:39.347Z", "datePublished": "2026-10-21T11:53:42.058Z", "dateUpdated": "2026-10-30T16:59:10.006Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-21T11:53:42.058Z"}, "title": "Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes", "problemTypes": [{"descriptions": [{"description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "packageURL": "pkg:github/apache/brpc", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.0", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://github.com", "packageName": "apache/brpc"}], "descriptions": [{"value": "Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.\n\nRoot Cause:\n1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g.\u00a064\u00a0MiB) can decompress to tens of GiB.\n2) The AMF string readers allocate the declared length before the bytes are actually available.\n3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.\n4) The sofa-pbrpc parser does not bound meta_size.\n5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.\n\nAffected Scenarios:\nAny bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.\n\nHow to Fix:(Choose one of the following options)\u00a01. Upgrade bRPC to version 1.18.0, which fixes this issue.\n\n2. Apply this patch:\u00a0https://github.com/apache/brpc/pull/3476\n\nNote:\nAfter the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Resource exhaustion in Apache bRPC (version &lt; 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.<br><br>Root Cause:<br>1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g.&nbsp;64&nbsp;MiB) can decompress to tens of GiB.<br>2) The AMF string readers allocate the declared length before the bytes are actually available.<br>3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.<br>4) The sofa-pbrpc parser does not bound meta_size.<br>5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.<br><br>Affected Scenarios:<br>Any bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.<br><br>How to Fix:<span>(Choose one of the following options)&nbsp;</span><div><span>1. Upgrade bRPC to version 1.18.0, which fixes this issue.</span></div><div><span>2. Apply this patch:&nbsp;</span>https://github.com/apache/brpc/pull/3476<br><br>Note:<br>After the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size).</div>"}]}], "references": [{"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "high"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Claude", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-78066", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T16:59:01.033553Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T16:58:44.127Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com", "defaultStatus": "unaffected", "packageName": "apache/brpc", "packageURL": "pkg:github/apache/brpc", "product": "Apache bRPC", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.18.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process.\n\nRoot Cause:\n1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g.\u00a064\u00a0MiB) can decompress to tens of GiB.\n2) The AMF string readers allocate the declared length before the bytes are actually available.\n3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing.\n4) The sofa-pbrpc parser does not bound meta_size.\n5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process.\n\nAffected Scenarios:\nAny bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients.\n\nHow to Fix:(Choose one of the following options)\u00a01. Upgrade bRPC to version 1.18.0, which fixes this issue.\n\n2. Apply this patch:\u00a0https://github.com/apache/brpc/pull/3476\n\nNote:\nAfter the fix, requests whose decompressed size, RTMP message length, or mcpack declared count exceed the new limits are rejected. Operators who legitimately need larger values can raise the corresponding flag (-max_decompressed_body_size, max_body_size)."}, {"lang": "es", "value": "Agotamiento de recursos en Apache bRPC (versiones anteriores a la 1.18.0) en todas las plataformas: varios analizadores que aceptan entrada controlada por el cable no imponen l\u00edmite en los tama\u00f1os declarados por el cliente o en la salida descomprimida, lo que los atacantes pueden usar para generar un uso desproporcionado de memoria y provocar el bloqueo del proceso.\\n\\nCausa ra\u00edz:\\n1) Los descompresores gzip/zlib/snappy no imponen l\u00edmite de salida: -max_body_size solo se verifica contra los bytes comprimidos, de modo que un cuerpo que cumple el l\u00edmite (p. ej., 64?MiB) puede descomprimirse a decenas de GiB.\\n2) Los lectores de cadenas AMF asignan la longitud declarada antes de que los bytes est\u00e9n realmente disponibles.\\n3) Los encabezados de fragmentos RTMP pueden volver a declarar una longitud de mensaje a mitad del flujo; la longitud declarada nunca estuvo limitada y el b\u00fafer de reensamblado parcial sigui\u00f3 creciendo.\\n4) El analizador sofa-pbrpc no limita meta_size.\\n5) mcpack2pb conf\u00eda en los recuentos de \u00edtems declarados por el cable para Reserve() y un value_size de cadena de 0 provoca un subdesbordamiento del tama\u00f1o del b\u00fafer, abortando el proceso.\\n\\nEscenarios afectados:\\nCualquier servicio bRPC que acepte cuerpos comprimidos con gzip/zlib/snappy o mensajes rtmp, sofa-pbrpc o mcpack2pb de clientes no confiables.\\n\\nC\u00f3mo corregir (elija una de las siguientes opciones):\\n1. Actualice bRPC a la versi\u00f3n 1.18.0, que corrige este problema.\\n2. Aplique este parche: https://github.com/apache/brpc/pull/3476\\n\\nNota:\\nDespu\u00e9s de la correcci\u00f3n, las solicitudes cuyo tama\u00f1o descomprimido, longitud de mensaje RTMP o recuento declarado por mcpack superen los nuevos l\u00edmites son rechazadas. Los operadores que necesiten valores mayores de forma leg\u00edtima pueden elevar la bandera correspondiente (-max_decompressed_body_size, max_body_size)."}], "id": "CVE-2026-78066", "lastModified": "2026-10-30T17:17:29.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78066", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T16:59:01.033553Z", "version": "2.0.3"}}]}, "published": "2026-10-21T12:17:23.527", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.18.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache bRPC", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "brpc", "vendor": "apache"}], "created": "2026-10-21T18:30:14.170501+00:00", "updated": "2026-10-30T19:00:17.805636+00:00", "vendors": ["apache", "apache$PRODUCT$brpc"]}