CVE-2026-78066 Apache Software Foundation CVE debrief

Who should care

Defenders of Apache bRPC services, particularly those accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients, should assess exposure and prioritize upgrading to version 1.18.0 or later.

Why it matters

Defenders of Apache bRPC services should be aware of the potential for resource exhaustion and prioritize upgrading to version 1.18.0 or later to mitigate the vulnerability.

• Potential for resource exhaustion and process crashes
• Need to verify and limit wire-declared sizes in bRPC services
• Possible impact on service availability and reliability

Technical summary

Apache bRPC is vulnerable to resource exhaustion due to unbounded decompression and unvalidated wire-declared sizes. Multiple parsers accept wire-controlled input with no limit on sizes declared by the client or on decompressed output, allowing attackers to drive disproportionate memory use and crash the process. The issue affects services accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients. The vulnerability was fixed in version 1.18.0, which enforces output limits for decompressors and validates wire-declared sizes.

Defensive priority

High

Recommended defensive actions

• Upgrade Apache bRPC to version 1.18.0 or later
• Review and limit wire-declared sizes in bRPC services
• Monitor bRPC services for unusual activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• technicalSummary

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and potential impact. The vulnerability was publicly disclosed on October 21, 2026. The source item and CVE record confirm the issue and provide context on the affected product and potential mitigations. Evidence limits indicate that the vulnerability affects multiple platforms and that defenders should verify and limit wire-declared sizes in bRPC services.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.