Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0...

Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams.

Root Cause:
In the streaming RPC feature, a client can declare multiple streams in one RPC request by putting extra stream identifiers into the repeated field stream_settings.extra_stream_ids of the RPC meta. On the server side, StreamAccept creates one response stream for every stream identifier declared by the request, without limiting the number of streams accepted in a single RPC. The request body size is only bounded by max_body_size (default 64MB), which is enough to carry millions of stream identifiers. Each accepted stream allocates its own bthread execution queue and associated resources, so a single crafted request can make the server create a huge number of streams and exhaust memory, leading to denial of service.

Affected Scenarios:
Use a bRPC server that serves streaming RPC and calls StreamAccept to accept streams from untrusted clients.

How to Fix:
(Choose one of the following options) 

1. Upgrade bRPC to the 1.18.0 version.
2. Apply this patch: https://github.com/apache/brpc/pull/3493

Note:
The fix adds a new gflag stream_max_streams_per_request with a default value of 64. Requests declaring more streams than the limit are rejected before any response stream is created. Applications that legit…