CVE-2026-80463

Apache bRPC (versions

CVE-2026-80463 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

CVE-2026-79704 Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extrastreamid for every additional stream. The response...

CVE-2026-79704

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0 ) on all platforms. The issue occurs because the client fails to validate the size of the returned list of extra_stream_ids in Controller::HandleStreamConnection when processing S...

EUVD-2026-107187

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extrastreamid for every additional stream. The response...

EUVD-2026-107184

Uncontrolled resource consumption in the HTTP/2 h2 receive path of Apache bRPC version 1.18.0 on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRP...

CVE-2026-74757 Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts t...

CVE-2026-74757 Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts t...

EUVD-2026-107181

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts t...

CVE-2026-74757

Apache bRPC (versions

CVE-2026-61902 Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits

Apache bRPC versions before 1.18.0 do not consistently enforce the configured maxbodysize limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured...

EUVD-2026-107176

Apache bRPC versions before 1.18.0 do not consistently enforce the configured maxbodysize limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured...

CVE-2026-61902

Apache bRPC versions before 1.18.0 are vulnerable to memory exhaustion due to inconsistent enforcement of the max_body_size limit during non-progressive HTTP/1 and HTTP/2 parsing, as well as memcache and couchbase response parsing. A remote unauthenticated peer can exploit this to buffer message ...

CVE-2026-58064

The Redis protocol implementation in Apache bRPC versions prior to 1.18.0 is vulnerable to a resource management error. The root cause is that the inline command parser allocates and copies the entire connection buffer based on its current size before determining the command boundary, and the red...

EUVD-2026-107175

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminati...

CVE-2026-58064 Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminati...

CVE-2026-56387 Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessiv...

CVE-2026-56387

The RTMP AMF parser in Apache bRPC versions prior to 1.18.0 is vulnerable to a resource management error. The parser accepts AMF string lengths and array counts directly from untrusted input, resizing destination strings to a 32-bit length before validating the actual stream content. This allows ...

EUVD-2026-107173

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a bRPC server with RTMP enabled can send a small AMF payload with an excessive declared long string length or array count, causing excessiv...

Security Bulletin: Multiple vulnerabilities in Python affect AIX

Summary Vulnerabilities in Python: SSL/TLS Security Vulnerabilities CVE-2026-19553, CVE-2026-19445, Archive Extraction / Tarfile Vulnerabilities CVE-2026-19672, CVE-2026-82049, CVE-2026-87910, Authentication / Credential Exposure CVE-2026-15806, Memory Management Vulnerabilities CVE-2026-15310,...