Apache bRPC: Denial of service via uncontrolled recursion (CVE-2026-82230)

Apache bRPC versions prior to 1.18.0 contain a vulnerability in the mcpack2pb component where the parser recursively handles nested objects and arrays without implementing a depth limit. An attacker can exploit this by sending a crafted mcpack request containing deeply nested structures to a bRPC server, causing stack overflow and a process crash. This affects servers configured to handle nshead_mcpack, ubrpc, or public_pbrpc requests. The patch enforces a maximum nesting depth of 128, which may impact legitimate traffic exceeding this limit.

Impact

Successful exploitation results in a denial-of-service condition due to application process crashes.

Recommendation

• Upgrade the Apache bRPC library to version 1.18.0 or later on all affected systems.
• If immediate upgrading is not possible, apply the official patch from the bRPC GitHub repository (pull request 3499).
• Prior to applying the fix, verify if your service environment relies on mcpack messages nested deeper than the new 128-level limit to prevent operational disruption.
• Review network boundaries to restrict access to bRPC services (nshead_mcpack, ubrpc, public_pbrpc) to trusted internal clients only.