Live › vulnerability › CVE-2026-82230
Go to dashboardApache bRPC before 1.18.0 parses nested mcpack objects with no depth limit, so a deeply nested request recurses until the stack overflows. An unauthenticated remote attacker can crash the server process with a single crafted request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers built on Apache bRPC that serve mcpack-based protocols (nshead_mcpack, ubrpc, public_pbrpc) and expose a protobuf message that references itself, such as a repeated message field, to untrusted networks. Services that do not use these mcpack protocols or have no recursive message schema are not described as exposed by the sources.
No product ranges from the sources yet.
1.18.0.nshead_mcpack, ubrpc or public_pbrpc requests with a recursive protobuf message schema.1.18.0.MAX_DEPTH of 128 on the parse path; requests nested deeper than 128 levels will fail after the fix).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.
Root Cause: The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.
Affected Scenarios: Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.
How to Fix: (Choose one of the following options)
Note: No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.
This page as .md · .json · in your agent: get_signal("CVE-2026-82230")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.