Read the docs
TI-2026-78737 Aliases CVE-2026-74757GHSA-px5f-q4rm-r7jp

Uncontrolled memory allocation in Apache bRPC mcpack2pb parser

Priority MEDIUM 40CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-770.

Summary

Apache bRPC before 1.18.0 is affected. The mcpack2pb parser trusts an array item count in the request without checking it against the payload size, so the server preallocates excessive memory (CWE-770). A remote attacker can send a crafted mcpack request with a huge item count, and the body is parsed before authentication, which may abort the server process on memory-constrained hosts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts the item count stored in the mcpack array header without validating it against the actual payload size. The code generated by the mcpack2pb protoc plugin uses this count to preallocate memory for repeated protobuf fields via Reserve(). A malformed request declaring item_count = 0x7fffffff can force the server to preallocate about 16GB of virtual memory, which may abort the process (SIGABRT) on memory-constrained hosts. Affected Scenarios: Use a bRPC server that wires a NsheadService to UbrpcMcpack2Adaptor (the Baidu ubrpc deployment pattern) and parses requests with code generated by the mcpack2pb protoc plugin. The request body is parsed before authentication. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3451 Note: No matter which option you choose, you should know that the fix caps the array item count to the remaining bytes of the array payload.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0063 50th percentileScored 2026-11-07
Fix Fixed Apache bRPC (Apache Software Foundation): 1.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache bRPCbefore 1.18.01.18.0Patch availableCNA
  • Apache bRPC VendorApache Affected before 1.18.0 Fixed in 1.18.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*——Apache
  • cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:* Versions — — ·Apache

Remediation

Upgrade Apache bRPC to version 1.18.0, which fixes this issue. Alternatively, apply the patch from pull request 3451 in the apache/brpc repository.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Apache bRPC (Apache Software Foundation) Fixed in 1.18.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache bRPC — lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

    35 records Highest priority Priority MEDIUM 18 MEDIUM, 17 LOW

    Other records, highest priority first

    • TI-2026-78552 Out-of-bounds write in Apache bRPC Redis command parserPriority MEDIUM 49
    • TI-2026-78757 Authentication bypass in Apache bRPC servers using internal_portPriority MEDIUM 48
    • TI-2026-78742 Missing authentication in Apache bRPC streaming RPC framesPriority MEDIUM 48
    Show all 35 records → Advisory →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-74757
  2. 2026-10-21 Alias added: GHSA-px5f-q4rm-r7jp
  3. 2026-10-26 CVSS score added · CISA ADP
  4. 2026-10-26 CISA SSVC decision points changed
  5. 2026-10-27 EPSS moved to the 50th–90th percentile
  6. 2026-10-27 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences