Live › vulnerability › CVE-2026-74755
Go to dashboardA crafted request with a zero-size string field in the mcpack2 parser makes an integer underflow throw an uncaught exception, aborting the bRPC server process. An unauthenticated remote attacker can crash the server with one request, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only bRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor, such as the NsheadService plus UbrpcMcpack2Adaptor pattern, are exposed to this flaw. Stock open-source bRPC registers the ubrpc and nshead_mcpack protocols as client-only, so default server configurations are not affected. Teams that only run bRPC clients or servers without this adaptor can skip it.
No product ranges from the sources yet.
grep -r "BRPC_VERSION\|1\.[0-9]*\.[0-9]*" $(brpc-config --include 2>/dev/null) or inspect the installed package version in your build manifestNsheadService combined with UbrpcMcpack2Adaptor or the ubrpc/nshead_mcpack protocol in server code1.18.01.18.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes _size - 1 without validating _size; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).
Root Cause:
In src/mcpack2pb/parser.cpp, UnparsedValue::as_string() resizes the output string to _size - 1, where _size is the value_size of a string field taken directly from the network data. A value_size of 0 underflows the unsigned size_t, and the subsequent resize() throws an exception that is not caught.
Affected Scenarios: bRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor (for example the NsheadService + UbrpcMcpack2Adaptor deployment pattern) can be crashed by a single unauthenticated request. Stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so default server configurations are not affected.
How to Fix:
This page as .md · .json · in your agent: get_signal("CVE-2026-74755")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.