BRPC (< 1.18.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/brpc--1.18.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 17:09:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache bRPC: Denial of service via uncontrolled recursion (CVE-2026-82230)https://feed.craftedsignal.io/briefs/2026-10-apache-brpc-cve-2026-82230/Wed, 21 Oct 2026 17:09:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-brpc-cve-2026-82230/Apache bRPC versions prior to 1.18.0 are vulnerable to stack exhaustion and process crashes when processing maliciously crafted, deeply nested mcpack data requests.Apache bRPC versions prior to 1.18.0 contain a vulnerability in the mcpack2pb component where the parser recursively handles nested objects and arrays without implementing a depth limit. An attacker can exploit this by sending a crafted mcpack request containing deeply nested structures to a bRPC server, causing stack overflow and a process crash. This affects servers configured to handle nshead_mcpack, ubrpc, or public_pbrpc requests. The patch enforces a maximum nesting depth of 128, which may impact legitimate traffic exceeding this limit.

Impact

Successful exploitation results in a denial-of-service condition due to application process crashes.

Recommendation

  • Upgrade the Apache bRPC library to version 1.18.0 or later on all affected systems.
  • If immediate upgrading is not possible, apply the official patch from the bRPC GitHub repository (pull request 3499).
  • Prior to applying the fix, verify if your service environment relies on mcpack messages nested deeper than the new 128-level limit to prevent operational disruption.
  • Review network boundaries to restrict access to bRPC services (nshead_mcpack, ubrpc, public_pbrpc) to trusted internal clients only.
]]>lowadvisorydenial-of-servicememory-corruptionpatch-management