# CVE-2026-81755: Apache bRPC uncontrolled resource consumption in streaming RPC

Source: https://junglewise.ai/threats/cve-2026-81755-uncontrolled-resource-consumption-in-the-streaming-rpc-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-81755 · Severity: info · Published 2026-10-21

Apache bRPC is a framework for building remote procedure call services. An attacker can send a specially crafted RPC request declaring millions of streams, causing the server to allocate excessive memory and become unavailable. This denial of service affects any bRPC server that processes streaming RPC requests from untrusted clients.

Technologies: [Apache Brpc](https://junglewise.ai/threats/technologies/brpc). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-81755 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81755 being exploited in the wild.

**How severe is CVE-2026-81755?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Brpc before 1.18.0.

**Is there a fix for CVE-2026-81755?** Yes: fixed in bRPC 1.18.0. Until then: Until upgrading, deploy the patch from https://github.com/apache/brpc/pull/3493 which adds a `stream_max_streams_per_request` flag (default 64) to reject requests exceeding the limit. For applications requiring more than 64 streams per request, increase this flag value accordingly. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81755 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81755?** Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in bRPC 1.18.0

Until upgrading, deploy the patch from https://github.com/apache/brpc/pull/3493 which adds a `stream_max_streams_per_request` flag (default 64) to reject requests exceeding the limit. For applications requiring more than 64 streams per request, increase this flag value accordingly.

## Technical details

The streaming RPC component lacks validation on the number of streams a client can declare in a single request via the `stream_settings.extra_stream_ids` field. Each accepted stream allocates its own execution queue and resources; an attacker can exhaust server memory by declaring more streams than the system can support in one RPC request. The vulnerability requires a network connection to a bRPC server using streaming RPC and affects versions before 1.18.0.

## Affected products

- Apache bRPC before 1.18.0

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Apache bRPC MySQL client null pointer dereference](https://junglewise.ai/threats/cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a)
- [Apache bRPC Discovery naming-service JSON parsing crash](https://junglewise.ai/threats/cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions)
- [brpc Server authentication bypass via internal_port](https://junglewise.ai/threats/cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and)
- [Apache bRPC path traversal and resource exhaustion in builtin services](https://junglewise.ai/threats/cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource)
- [Apache bRPC HTTP request/response smuggling in bundled parser](https://junglewise.ai/threats/cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request)