CVE-2026-74755 Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-74755?
CVE-2026-74755 is a vulnerability in Apache bRPC, published on 21 Oct 2026.
Official description
An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).
Root Cause: In src/mcpack2pb/parser.cpp, UnparsedValue::as_string() resizes the output string to `_size - 1`, where `_size` is the value_size of a string field taken directly from the network data. A value_size of 0 underflows the unsigned size_t, and the subsequent resize() throws an exception that is not caught.
Affected Scenarios: bRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor (for example the NsheadService + UbrpcMcpack2Adaptor deployment pattern) can be crashed by a single unauthenticated request. Stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so default server configurations are not affected.
How to Fix: 1. Upgrade bRPC to a version that includes this fix. 2. Apply the patch in PR https://github.com/apache/brpc/pull/3450
Weakness: CWE-191
Which versions are affected by CVE-2026-74755?
How do I fix CVE-2026-74755?
No fix has been published for CVE-2026-74755 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-74755 being exploited?
There is no known exploitation of CVE-2026-74755 in the wild and no public exploit code.
Sources
Also known as GHSA-9644-97m2-4fc3.