Apache bRPC CVE-2026-78066

The bRPC service must accept one of the specific affected input types from untrusted clients: gzip/zlib/snappy-compressed request bodies (whose decompressed output is unbounded while only the compressed size is capped by -max_body_size), or RTMP chunk-stream messages, sofa-pbrpc messages (unbounded meta_size), or mcpack2pb messages (wire-declared item counts used for Reserve(), and a string value_size of 0 underflowing the buffer size and aborting). No authentication is required because these parsers process wire-declared sizes before any auth check. Exploitation is LIMITED to deployments that actually expose these parsers/protocols to an untrusted network; a bRPC service that does not accept compressed bodies or these legacy protocols, or that only serves trusted internal peers, is not reachably affected.

This is a credible denial-of-service priority for anyone running Apache bRPC <= 1.17.0 on untrusted-facing ports, but it is a confirmed-DoS rather than a code-execution issue. No CVSS vector was supplied in the input (CVSS Score: N/A, CVSS Vector: N/A), so attack-vector/complexity/privilege signals are inferred from the description, not confirmed by NVD. The vendor advisory rates it 'high'. The description strongly implies network-reachable, pre-authentication exploitation ('from untrusted clients', parsers that 'accept wire-controlled input'), consistent with an unauthenticated remote DoS. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active exploitation or published exploit code - exploitation status is 'no public exploit identified at time of analysis'. Technical impact is bounded to availability (process crash or unbounded memory growth); there is no confidentiality or integrity impact described. Net: treat as a high-priority patch for internet- or multi-tenant-exposed bRPC services, but a lower-urgency issue where bRPC only serves trusted internal clients or does not accept the affected compression/protocol formats. The 'high' severity reflects impact and easy reachability, not any evidence of widespread exploitation.

A remote, unauthenticated attacker sends a bRPC service a request body that is compliant with the -max_body_size cap on the compressed wire (e.g. 64 MiB of gzip/zlib/snappy) but decompresses to tens of GiB, or an RTMP/sofa-pbrpc/mcpack2pb message with an inflated wire-declared length/item count. bRPC allocates or inflates based on the untrusted declared size before validation, exhausting memory or hitting an abort and crashing the process. No public exploit code is identified at time of analysis, but the condition is trivially constructed and requires no authentication.