CVE-2026-61902— Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
Quick assessment
Affected
Apache Software Foundation Apache bRPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache bRPC 在 1.18.0 之前的版本中，在非渐进式 HTTP/1 和 HTTP/2 解析，以及 Memcache 和 Couchbase 响应解析过程中，未能始终一致地执行配置的 限制。 远程未认证的攻击者可使受影响的进程缓冲超出配置限制的消息数据，从而导致内存耗尽并引发拒绝服务（DoS）攻击。 建议用户升级至 1.18.0 版本，或应用来自 PR https://github.com/apache/brpc/pull/3382 的补丁。该修复措施会拒绝超大的缓冲 HTTP 请求体：对 HTTP/1
Possible ATT&CK Techniques 1 AI
T1499.003 · Application Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-61902
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
Source: CVE Program / CVE List V5
Vulnerability Description
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.
A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service.
Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache bRPC | 0 ~ 1.18.0 | - |
|
II. Public POCs for CVE-2026-61902
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-61902
请登录查看更多情报信息。
Other References for CVE-2026-61902 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-21 · 39 CVEs total
| CVE-2026-56386 | Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser | |
| CVE-2026-78048 | Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Deco | |
| CVE-2026-74758 | Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling | |
| CVE-2026-74757 | Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count | |
| CVE-2026-74755 | Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service | |
| CVE-2026-66392 | Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names | |
| CVE-2026-61916 | Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms | |
| CVE-2026-58064 | Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation | |
| CVE-2026-56388 | Apache bRPC: Out-of-Bounds Write in Redis Command Parser | |
| CVE-2026-56387 | Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser | |
| CVE-2026-78058 | Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path | |
| CVE-2026-54427 | Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser | |
| CVE-2026-54426 | Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser | |
| CVE-2026-54425 | Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding | |
| CVE-2026-48830 | Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for | |
| CVE-2026-59229 | Apache IoTDB: Legacy Pipe Privilege Escalation | |
| CVE-2026-59562 | Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe send | |
| CVE-2026-41114 | Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JD | |
| CVE-2026-58663 | Apache IoTDB: Auth Bypass in pipeTransfer() interface | |
| CVE-2026-82425 | Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache bRPC
-
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser -
CVE-2026-87849
Apache bRPC: Out-of-bounds read via non-object fields in Dis -
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-86147
Apache bRPC: Arbitrary file creation/truncation via /flags a -
CVE-2026-86146
Apache bRPC: HTTP Request Smuggling and Header Injection via
Same vendor: Apache Software Foundation
-
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser -
CVE-2026-87849
Apache bRPC: Out-of-bounds read via non-object fields in Dis -
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-86147
Apache bRPC: Arbitrary file creation/truncation via /flags a -
CVE-2026-86146
Apache bRPC: HTTP Request Smuggling and Header Injection via
Same weakness: CWE-400
-
CVE-2026-20356
Multiple Cisco Products Snort 3 Software Hardening Release: -
CVE-2026-113795
pypdf: Possible large memory usage for streams with multiple -
CVE-2026-113791
pypdf: Possible large memory usage when parsing content stre -
CVE-2026-113790
pypdf: Possible large memory usage when parsing arrays and d -
CVE-2026-113789
pypdf: Possible long runtimes/large memory usage when retrie
V. Comments for CVE-2026-61902
No comments yet