CVE-2026-80463

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description Unbounded memory accumulation in the stream message reassembly path allows remote attackers to cause a denial of service by sending an endless sequence of continuation data frames. While the streaming RPC protocol bounds individual data frames by max body size, fragmented stream messages accumulate continuation frames into the pending buf buffer without a size limit. Because default flow-control settings (socket max streams unconsumed bytes=0) do not throttle the sending rate, a malicious peer can force the receiver to accumulate an arbitrarily large in-memory message, leading to memory exhaustion and system crashes. This affects services accepting streams from untrusted clients via brpc::StreamAccept or brpc::StreamCreate using the built-in streaming protocol.

Recommendations Upgrade Apache bRPC to version 1.18.0. Adjust the max body size gflag to accommodate legitimate fragmented stream messages that exceed the default 64MB limit after applying the fix.