CVE-2026-82230

Deferred Deferred - Pending Action

Stack Overflow in Apache bRPC mcpack2pb Parser

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Apache Software Foundation

Description

Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process. Affected Scenarios: Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3499 Note: No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-26

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-82230

EUVD

EUVD-2026-107217

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled recursion in Apache bRPC's mcpack2pb component (versions before 1.18.0). Attackers can crash the server by sending deeply nested mcpack data, causing a stack overflow due to unbounded recursion during parsing.

Detection Guidance

Detecting this vulnerability requires checking if your bRPC server is running a vulnerable version (< 1.18.0) and if it handles nshead_mcpack, ubrpc, or public_pbrpc requests. Inspect server logs for crashes or stack overflow errors during request processing. No specific commands are provided in the context.

Impact Analysis

The vulnerability allows remote attackers to crash the bRPC server by sending specially crafted mcpack data. This results in a denial-of-service (DoS) condition, making the server unavailable for legitimate users.

Compliance Impact

This vulnerability causes a denial-of-service (DoS) condition by crashing the server through stack overflow, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could interrupt critical healthcare services dependent on bRPC servers.

Mitigation Strategies

Upgrade bRPC to version 1.18.0 or apply the patch from https://github.com/apache/brpc/pull/3499. Ensure the fix is applied to all servers handling nshead_mcpack, ubrpc, or public_pbrpc requests from untrusted networks.

Hi! I’m here to help you understand CVE-2026-82230. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...