Live › vulnerability › CVE-2026-74757
Go to dashboardA crafted mcpack request with a huge array item count makes the bRPC server preallocate a very large amount of memory, which can abort the process. An unauthenticated remote attacker can trigger it because the body is parsed before authentication.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers built on bRPC that expose an nshead service through UbrpcMcpack2Adaptor and parse requests with mcpack2pb-generated code. The request body is parsed before authentication, so the attack needs no credentials. Services that do not use the mcpack2pb path, or that run newer than 1.18.0, are not affected.
No product ranges from the sources yet.
NsheadService and UbrpcMcpack2Adaptor (the ubrpc deployment pattern) and code generated by the mcpack2pb protoc plugin.1.18.0.1.18.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count.
Root Cause: The bRPC mcpack2pb parser trusts the item count stored in the mcpack array header without validating it against the actual payload size. The code generated by the mcpack2pb protoc plugin uses this count to preallocate memory for repeated protobuf fields via Reserve(). A malformed request declaring item_count = 0x7fffffff can force the server to preallocate about 16GB of virtual memory, which may abort the process (SIGABRT) on memory-constrained hosts.
Affected Scenarios: Use a bRPC server that wires a NsheadService to UbrpcMcpack2Adaptor (the Baidu ubrpc deployment pattern) and parses requests with code generated by the mcpack2pb protoc plugin. The request body is parsed before authentication.
How to Fix: (Choose one of the following options)
Note: No matter which option you choose, you should know that the fix caps the array item count to the remaining bytes of the array payload.
This page as .md · .json · in your agent: get_signal("CVE-2026-74757")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.