228 matches found
CVE-2026-82230 Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
Uncontrolled recursion in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser used to serve nsheadmcpack / ubrpc / publicpbrpc requests recursively pars...
CVE-2026-82210
Apache bRPC versions earlier than 1.18.0 are vulnerable to a Remote Denial of Service (DoS) via a reachable assertion (CWE-617 ). The issue occurs in the streaming feature when the server handles FRAME_TYPE_FEEDBACK frames. Specifically, the Stream::SetRemoteConsumed() function contains assertion...
EUVD-2026-107216
Enforceable assertion in the streaming feature of Apache bRPC version 0 and unconditionally asserts CHECKbuf.IsEmpty on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled curbufsize == 0, reaches these...
CVE-2026-82210 Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
Enforceable assertion in the streaming feature of Apache bRPC version 0 and unconditionally asserts CHECKbuf.IsEmpty on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled curbufsize == 0, reaches these...
CVE-2026-81755
Apache bRPC versions prior to 1.18.0 are vulnerable to uncontrolled resource consumption in the streaming RPC component. An attacker can exploit the StreamAccept function by sending a single RPC request containing an excessive number of stream identifiers in the stream_settings.extra_stream_ids f...
EUVD-2026-107189
Uncontrolled resource consumption in the streaming RPC component of Apache bRPC version 1.18.0 allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root Cause: In the streaming RPC feature, a...
CVE-2026-81755 Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
Uncontrolled resource consumption in the streaming RPC component of Apache bRPC version 1.18.0 allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. Root Cause: In the streaming RPC feature, a...
CVE-2026-80463
Apache bRPC (version
EUVD-2026-107188
Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...
CVE-2026-80463 Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...
CVE-2026-79704
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0 ) on all platforms. The root cause is that the Controller::HandleStreamConnection path indexes returned extra_stream_ids using the local stream count without validating the return...
EUVD-2026-107187
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extrastreamid for every additional stream. The response...
CVE-2026-79704 Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extrastreamid for every additional stream. The response...
CVE-2026-78334
Apache bRPC versions
EUVD-2026-107186
Missing authentication in the streaming RPC path of Apache bRPC version 1.18.0 on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured,...
CVE-2026-78334 Apache bRPC: Missing Authentication for Streaming RPC Frames
Missing authentication in the streaming RPC path of Apache bRPC version 1.18.0 on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured,...
EUVD-2026-107185
Resource exhaustion in Apache bRPC version 1.18.0 on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1 Th...
CVE-2026-78066 Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
Resource exhaustion in Apache bRPC version 1.18.0 on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1 Th...