CVE-2026-61902 Details
Description
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.
A memory exhaustion vulnerability has been identified in Apache bRPC versions prior to 1.18.0. The issue arises because these versions do not consistently enforce the max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing, as well as in memcache and couchbase response parsing. This inconsistency allows a remote unauthenticated peer to send message data that exceeds the configured limit, leading to excessive memory consumption and a denial-of-service condition.
Users are advised to upgrade to Apache bRPC version 1.18.0 or later. Alternatively, the patch available in PR #3382 can be applied. This patch ensures that oversized buffered HTTP bodies are rejected, returns an HTTP 413 status for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects memcache and couchbase responses that exceed their declared lengths.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb | [email protected] | AdvisoryBundleMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache bRPC | < 1.18.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | CVE Translated | [email protected] |
| Oct 21, 2026 | New CVE Received | [email protected] |