CVE-2026-61902 Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-61902?
CVE-2026-61902 is a vulnerability in Apache bRPC, published on 21 Oct 2026.
Official description
Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing.
A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. Users should upgrade to 1.18.0 or apply the patch from PR https://github.com/apache/brpc/pull/3382 . The fix rejects oversized buffered HTTP bodies, returns HTTP 413 for HTTP/1 requests, resets oversized HTTP/2 streams, and rejects oversized memcache and couchbase responses from their declared lengths. Progressive HTTP reading remains supported because it uses bounded buffering.
Weakness: CWE-400
Which versions are affected by CVE-2026-61902?
How do I fix CVE-2026-61902?
No fix has been published for CVE-2026-61902 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-61902 being exploited?
There is no known exploitation of CVE-2026-61902 in the wild and no public exploit code.
Sources
Also known as GHSA-3hm8-f7vm-2c3r.