---
id: "CVE-2026-82230"
kind: "vulnerability"
aliases: ["CVE-2026-82230"]
title: "Apache bRPC: deeply nested mcpack requests crash the server process"
severity: "high"
cvss: 7.5
epss: 0.0055
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-brpc", "c++", "package", "rpc-servers", "self-hosted"]
not_affected_if: ["brpc-1.18.0-or-later", "no-mcpack-protocol", "non-recursive-schema"]
published_at: "2026-10-21T13:20:02+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:16:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82230", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-82230", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache bRPC: deeply nested mcpack requests crash the server process

Apache bRPC before 1.18.0 parses nested mcpack objects with no depth limit, so a deeply nested request recurses until the stack overflows. An unauthenticated remote attacker can crash the server process with a single crafted request.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the bRPC version in your build or lockfile; affected if below `1.18.0`.
- Look for servers that accept `nshead_mcpack`, `ubrpc` or `public_pbrpc` requests with a recursive protobuf message schema.

## Fix

- Upgrade bRPC to `1.18.0`.
- Or apply the patch from https://github.com/apache/brpc/pull/3499 (enforces `MAX_DEPTH` of 128 on the parse path; requests nested deeper than 128 levels will fail after the fix).

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82230
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-82230

## From the sources

Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.

Root Cause:
The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.

Affected Scenarios:
Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.

How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3499

Note:
No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_