CVE-2026-61902: Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits

Q: Which deployments are exposed to remote exploitation?

Affected Apache bRPC versions before 1.18.0 are exposed when they parse non-progressive HTTP/1 or HTTP/2 message bodies, or parse memcache or couchbase responses. A remote unauthenticated peer can trigger excessive buffering and potentially exhaust process memory.

Q: Does configuring max_body_size prevent this issue?

No. The issue is that max_body_size is not consistently enforced in the affected non-progressive HTTP parsing paths and memcache and couchbase response parsing.

Q: What mitigation is available if an immediate upgrade is not possible?

Apply the patch from PR 3382. Progressive HTTP reading remains supported with bounded buffering, so using progressive HTTP reading avoids the affected HTTP buffering behavior.

Published Oct 21, 2026

Updated

Apache bRPC versions before 1.18.0 do not consistently enforce the configured maxbodysize limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.

A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.

Affected Software

1 affected component

Apache bRPC<1.18.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache bRPC to a version that resolves this vulnerability.
Fixed in 1.18.0

Event History

Oct 21, 2026

CVE Published

via MITRE·11:41 AM

Data Sourced

via MITRE·11:41 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Affected Apache bRPC versions before 1.18.0 are exposed when they parse non-progressive HTTP/1 or HTTP/2 message bodies, or parse memcache or couchbase responses. A remote unauthenticated peer can trigger excessive buffering and potentially exhaust process memory.

Does configuring max_body_size prevent this issue?

No. The issue is that max_body_size is not consistently enforced in the affected non-progressive HTTP parsing paths and memcache and couchbase response parsing.

What mitigation is available if an immediate upgrade is not possible?

Apply the patch from PR 3382. Progressive HTTP reading remains supported with bounded buffering, so using progressive HTTP reading avoids the affected HTTP buffering behavior.

How does the fixed behavior handle oversized input?

The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for oversized HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses based on their declared lengths.