CVE-2026-81755 (GCVE-0-2026-81755)
Vulnerability from cvelistv5
Published
2026-10-21 11:58
Modified
2026-10-30 14:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-400 - Uncontrolled Resource Consumption
Summary
Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams.
Root Cause:
In the streaming RPC feature, a client can declare multiple streams in one RPC request by putting extra stream identifiers into the repeated field `stream_settings.extra_stream_ids` of the RPC meta. On the server side, `StreamAccept` creates one response stream for every stream identifier declared by the request, without limiting the number of streams accepted in a single RPC. The request body size is only bounded by `max_body_size` (default 64MB), which is enough to carry millions of stream identifiers. Each accepted stream allocates its own bthread execution queue and associated resources, so a single crafted request can make the server create a huge number of streams and exhaust memory, leading to denial of service.
Affected Scenarios:
Use a bRPC server that serves streaming RPC and calls `StreamAccept` to accept streams from untrusted clients.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to the 1.18.0 version.
2. Apply this patch: https://github.com/apache/brpc/pull/3493
Note:
The fix adds a new gflag `stream_max_streams_per_request` with a default value of 64. Requests declaring more streams than the limit are rejected before any response stream is created. Applications that legitimately need to accept more than 64 streams in one RPC must raise this flag; otherwise such requests will fail after applying the fix.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache bRPC |
Version: 0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-81755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T14:21:58.462486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:22:06.684Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageName": "apache/brpc",
"packageURL": "pkg:github/apache/brpc",
"product": "Apache bRPC",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.18.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claude"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version \u0026lt; 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams.\u003cbr\u003e\u003cbr\u003eRoot Cause:\u003cbr\u003eIn the streaming RPC feature, a client can declare multiple streams in one RPC request by putting extra stream identifiers into the repeated field \u003cspan\u003e`stream_settings.extra_stream_ids`\u003c/span\u003e of the RPC meta. On the server side, \u003cspan\u003e`StreamAccept`\u003c/span\u003e creates one response stream for every stream identifier declared by the request, without limiting the number of streams accepted in a single RPC. The request body size is only bounded by \u003cspan\u003e`max_body_size`\u003c/span\u003e (default 64MB), which is enough to carry millions of stream identifiers. Each accepted stream allocates its own bthread execution queue and associated resources, so a single crafted request can make the server create a huge number of streams and exhaust memory, leading to denial of service.\u003cbr\u003e\u003cbr\u003eAffected Scenarios:\u003cbr\u003eUse a bRPC server that serves streaming RPC and calls \u003cspan\u003e`StreamAccept`\u003c/span\u003e to accept streams from untrusted clients.\u003cbr\u003e\u003cbr\u003eHow to Fix: \u003cbr\u003e(\u003cspan\u003eChoose one of the following options)\u0026nbsp;\u003c/span\u003e\u003cbr\u003e1. Upgrade bRPC to the 1.18.0 version.\u003cbr\u003e\u003cspan\u003e2. Apply this patch: \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3493\"\u003ehttps://github.com/apache/brpc/pull/3493\u003c/a\u003e\n\u003cbr\u003e\u003cbr\u003eNote:\u003cbr\u003eThe fix adds a new gflag \u003cspan\u003e`stream_max_streams_per_request`\u003c/span\u003e with a default value of 64. Requests declaring more streams than the limit are rejected before any response stream is created. Applications that legitimately need to accept more than 64 streams in one RPC must raise this flag; otherwise such requests will fail after applying the fix."
}
],
"value": "Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version \u003c 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams.\n\nRoot Cause:\nIn the streaming RPC feature, a client can declare multiple streams in one RPC request by putting extra stream identifiers into the repeated field `stream_settings.extra_stream_ids` of the RPC meta. On the server side, `StreamAccept` creates one response stream for every stream identifier declared by the request, without limiting the number of streams accepted in a single RPC. The request body size is only bounded by `max_body_size` (default 64MB), which is enough to carry millions of stream identifiers. Each accepted stream allocates its own bthread execution queue and associated resources, so a single crafted request can make the server create a huge number of streams and exhaust memory, leading to denial of service.\n\nAffected Scenarios:\nUse a bRPC server that serves streaming RPC and calls `StreamAccept` to accept streams from untrusted clients.\n\nHow to Fix: \n(Choose one of the following options)\u00a0\n1. Upgrade bRPC to the 1.18.0 version.\n2. Apply this patch: https://github.com/apache/brpc/pull/3493 \n\n\nNote:\nThe fix adds a new gflag `stream_max_streams_per_request` with a default value of 64. Requests declaring more streams than the limit are rejected before any response stream is created. Applications that legitimately need to accept more than 64 streams in one RPC must raise this flag; otherwise such requests will fail after applying the fix."
}
],
"metrics": [
{
"other": {
"content": {
"text": "medium"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T11:58:26.104Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-81755",
"datePublished": "2026-10-21T11:58:26.104Z",
"dateReserved": "2026-08-27T12:21:32.957Z",
"dateUpdated": "2026-10-30T14:22:06.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-10-21T11:58:26.104Z\"}, \"title\": \"Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request\", \"problemTypes\": [{\"descriptions\": [{\"description\": \"CWE-400 Uncontrolled Resource Consumption\", \"lang\": \"en\", \"cweId\": \"CWE-400\", \"type\": \"CWE\"}]}], \"source\": {\"discovery\": \"INTERNAL\"}, \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache bRPC\", \"packageURL\": \"pkg:github/apache/brpc\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.18.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\", \"collectionURL\": \"https://github.com\", \"packageName\": \"apache/brpc\"}], \"descriptions\": [{\"value\": \"Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version \u003c 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams.\\n\\nRoot Cause:\\nIn the streaming RPC feature, a client can declare multiple streams in one RPC request by putting extra stream identifiers into the repeated field `stream_settings.extra_stream_ids` of the RPC meta. On the server side, `StreamAccept` creates one response stream for every stream identifier declared by the request, without limiting the number of streams accepted in a single RPC. The request body size is only bounded by `max_body_size` (default 64MB), which is enough to carry millions of stream identifiers. Each accepted stream allocates its own bthread execution queue and associated resources, so a single crafted request can make the server create a huge number of streams and exhaust memory, leading to denial of service.\\n\\nAffected Scenarios:\\nUse a bRPC server that serves streaming RPC and calls `StreamAccept` to accept streams from untrusted clients.\\n\\nHow to Fix: \\n(Choose one of the following options)\\u00a0\\n1. Upgrade bRPC to the 1.18.0 version.\\n2. Apply this patch: https://github.com/apache/brpc/pull/3493 \\n\\n\\nNote:\\nThe fix adds a new gflag `stream_max_streams_per_request` with a default value of 64. Requests declaring more streams than the limit are rejected before any response stream is created. Applications that legitimately need to accept more than 64 streams in one RPC must raise this flag; otherwise such requests will fail after applying the fix.\", \"lang\": \"en\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version \u0026lt; 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams.\u003cbr\u003e\u003cbr\u003eRoot Cause:\u003cbr\u003eIn the streaming RPC feature, a client can declare multiple streams in one RPC request by putting extra stream identifiers into the repeated field \u003cspan\u003e`stream_settings.extra_stream_ids`\u003c/span\u003e of the RPC meta. On the server side, \u003cspan\u003e`StreamAccept`\u003c/span\u003e creates one response stream for every stream identifier declared by the request, without limiting the number of streams accepted in a single RPC. The request body size is only bounded by \u003cspan\u003e`max_body_size`\u003c/span\u003e (default 64MB), which is enough to carry millions of stream identifiers. Each accepted stream allocates its own bthread execution queue and associated resources, so a single crafted request can make the server create a huge number of streams and exhaust memory, leading to denial of service.\u003cbr\u003e\u003cbr\u003eAffected Scenarios:\u003cbr\u003eUse a bRPC server that serves streaming RPC and calls \u003cspan\u003e`StreamAccept`\u003c/span\u003e to accept streams from untrusted clients.\u003cbr\u003e\u003cbr\u003eHow to Fix: \u003cbr\u003e(\u003cspan\u003eChoose one of the following options)\u0026nbsp;\u003c/span\u003e\u003cbr\u003e1. Upgrade bRPC to the 1.18.0 version.\u003cbr\u003e\u003cspan\u003e2. Apply this patch: \u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://github.com/apache/brpc/pull/3493\\\"\u003ehttps://github.com/apache/brpc/pull/3493\u003c/a\u003e\\n\u003cbr\u003e\u003cbr\u003eNote:\u003cbr\u003eThe fix adds a new gflag \u003cspan\u003e`stream_max_streams_per_request`\u003c/span\u003e with a default value of 64. Requests declaring more streams than the limit are rejected before any response stream is created. Applications that legitimately need to accept more than 64 streams in one RPC must raise this flag; otherwise such requests will fail after applying the fix.\"}]}], \"references\": [{\"url\": \"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb\", \"tags\": [\"vendor-advisory\"]}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"medium\"}}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Claude\", \"type\": \"finder\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-81755\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-30T14:21:58.462486Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-30T14:20:46.423Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-81755\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"apache\", \"dateReserved\": \"2026-08-27T12:21:32.957Z\", \"datePublished\": \"2026-10-21T11:58:26.104Z\", \"dateUpdated\": \"2026-10-30T14:22:06.684Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…