{"id":"CVE-2026-82230","kind":"vulnerability","aliases":["CVE-2026-82230"],"related":[],"title":"Apache bRPC: deeply nested mcpack requests crash the server process","description":"Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.\n\nRoot Cause:\nThe bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.\n\nAffected Scenarios:\nUse bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3499\n\nNote:\nNo matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.","summary":"Apache bRPC before 1.18.0 parses nested mcpack objects with no depth limit, so a deeply nested request recurses until the stack overflows. An unauthenticated remote attacker can crash the server process with a single crafted request.","severity":"high","cvss":7.5,"epss":0.0055,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-brpc","c++","package","rpc-servers","self-hosted"],"not_affected_if":["brpc-1.18.0-or-later","no-mcpack-protocol","non-recursive-schema"],"how_to_check":"- Check the bRPC version in your build or lockfile; affected if below `1.18.0`.\n- Look for servers that accept `nshead_mcpack`, `ubrpc` or `public_pbrpc` requests with a recursive protobuf message schema.","fix":"- Upgrade bRPC to `1.18.0`.\n- Or apply the patch from https://github.com/apache/brpc/pull/3499 (enforces `MAX_DEPTH` of 128 on the parse path; requests nested deeper than 128 levels will fail after the fix).","status":"open","published_at":"2026-10-21T13:20:02+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:51+00:00","updated_at":"2026-10-25T03:16:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:16:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bRPC to `1.18.0`.\n- Or apply the patch from https://github.com/apache/brpc/pull/3499 (enforces `MAX_DEPTH` of 128 on the parse path; requests nested deeper than 128 levels will fail after the fix).","reach":"internet","title":"Apache bRPC: deeply nested mcpack requests crash the server process","impact":"medium","summary":"Apache bRPC before 1.18.0 parses nested mcpack objects with no depth limit, so a deeply nested request recurses until the stack overflows. An unauthenticated remote attacker can crash the server process with a single crafted request.","category":"package","nicknames":[],"who_cares":["apache-brpc","c++","self-hosted","rpc-servers"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker crashes the bRPC server process with a deeply nested request.","analyst_note":"","how_to_check":"- Check the bRPC version in your build or lockfile; affected if below `1.18.0`.\n- Look for servers that accept `nshead_mcpack`, `ubrpc` or `public_pbrpc` requests with a recursive protobuf message schema.","needs_analyst":false,"not_affected_if":["no-mcpack-protocol","non-recursive-schema","brpc-1.18.0-or-later"],"who_is_affected":"Servers built on Apache bRPC that serve mcpack-based protocols (nshead_mcpack, ubrpc, public_pbrpc) and expose a protobuf message that references itself, such as a repeated message field, to untrusted networks. Services that do not use these mcpack protocols or have no recursive message schema are not described as exposed by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":3730,"output_tokens":633,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82230':13A,16A '/apache/brpc/pull/3499':206C '1':190C '1.18.0':31B,74C,195C '128':228C,249C '2':200C 'affect':158C 'allow':78C 'alreadi':238C 'apach':1A,18B,28B,71C 'apache-brpc':17B 'appli':201C,239C,257C 'array':112C 'attack':53B,80C 'brpc':2A,19B,29B,72C,95C,161C,192C 'c':20B 'caus':93C 'choos':184C,213C 'compon':69C 'contain':243C 'craft':62B 'crash':7A,55B,85C,155C 'cve':11A,14A 'data':91C 'deeper':247C 'deepli':3A,42B,88C,143C 'depth':38B,115C,224C,227C 'document':222C 'e.g':124C 'enforc':220C 'fail':255C 'field':128C 'fix':183C,197C,219C,259C 'follow':188C 'generat':130C 'github.com':205C 'github.com/apache/brpc/pull/3499':204C 'grow':149C 'host':27B 'incom':139C 'issu':199C 'know':216C 'level':136C,250C 'limit':39B,116C,225C,235C 'make':82C,146C 'matter':209C 'max':226C 'mcpack':5A,34B,90C,102C,140C,173C,244C 'mcpack2pb':68C,96C 'messag':120C,127C,169C,245C 'nest':4A,33B,43B,89C,109C,135C,144C,246C 'network':180C 'note':207C 'nshead':101C,172C 'object':35B,110C,141C 'one':185C 'option':189C,211C 'overflow':49B,151C 'packag':21B 'pars':32B,108C,223C,231C 'parser':97C,131C 'patch':203C 'path':232C 'pbrpc':105C,176C 'per':134C 'platform':77C 'process':10A,58B,157C 'protobuf':119C,168C 'public':104C,175C 'recurs':45B,65C,107C,132C,148C,166C 'recursive-schema':165C 'refer':122C 'remot':52B,79C 'repeat':126C 'request':6A,44B,63B,106C,145C,177C,242C,252C 'root':92C 'rpc':23B 'rpc-server':22B 'scenario':159C 'schema':167C 'self':26B 'self-host':25B 'send':87C 'serial':237C 'serv':100C,171C 'server':9A,24B,57B,84C,162C 'singl':61B 'stack':48B,153C 'ubrpc':103C,174C 'unauthent':51B 'unbound':150C 'uncontrol':64C 'untrust':179C 'upgrad':191C 'use':98C,160C 'version':73C,194C 'via':86C 'without':113C","nicknames":[],"mitigations":[],"who_affected":"Servers built on Apache bRPC that serve mcpack-based protocols (nshead_mcpack, ubrpc, public_pbrpc) and expose a protobuf message that references itself, such as a repeated message field, to untrusted networks. Services that do not use these mcpack protocols or have no recursive message schema are not described as exposed by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:20:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82230","severity":null,"published_at":"2026-10-21T13:20:02+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-82230","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-82230","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}