CVE-2026-78066

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description Resource exhaustion occurs across all platforms due to multiple parsers failing to limit sizes declared by the client or the size of decompressed output. This allows attackers to cause disproportionate memory consumption and crash the process. The issue stems from several root causes: gzip, zlib, and snappy decompressors do not enforce output limits, as -max body size only checks compressed bytes; AMF string readers allocate declared lengths before bytes are available; RTMP chunk headers allow unbounded message length re-declarations mid-stream; the sofa-pbrpc parser does not bound meta size; and mcpack2pb trusts wire-declared item counts for Reserve(), where a value size of 0 can cause a buffer size underflow.

Recommendations Upgrade to version 1.18.0. Apply the official patch provided in pull request 3476. For operators requiring larger values after the fix, increase the -max decompressed body size and max body size flags.