CVE-2026-81755

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description Uncontrolled resource consumption in the streaming RPC component allows a remote attacker to cause a denial of service by exhausting server memory. This occurs when a client sends a single RPC request containing an excessive number of stream identifiers within the stream settings.extra stream ids field of the RPC meta. The server-side StreamAccept() function creates a response stream for every declared identifier without imposing a limit. Since the request body size is bounded by max body size (default 64MB), it can accommodate millions of identifiers. Each stream allocates a bthread execution queue and associated resources, leading to memory exhaustion.

Recommendations Upgrade Apache bRPC to version 1.18.0. Apply the official patch for the streaming RPC component. For applications requiring more than 64 streams in one RPC after updating, increase the stream max streams per request gflag.