Attack Chain

1. An unauthenticated attacker establishes a connection to a vulnerable rpcx service.
2. The attacker crafts a malicious rpcx message with the compression flag set.
3. The payload of this message consists of a small (under 2 MB) gzip-compressed data stream engineered to expand exponentially upon decompression.
4. The attacker sends this crafted message over the established connection to the rpcx service.
5. The rpcx service's readRequest function receives the message prior to any authentication checks.
6. The protocol.Message.Decode function is invoked to process the message, which subsequently calls util.Unzip to decompress the payload.
7. During the decompression process, the maliciously crafted payload expands to consume gigabytes of the service's memory.
8. The service encounters an out-of-memory (OOM) condition, leading to its crash and resulting in a denial of service.

Impact

The primary impact of CVE-2026-59803 is the complete denial of service for affected rpcx applications. Exploitation is unauthenticated, meaning any external attacker can crash vulnerable services, rendering them unavailable to legitimate users. This can lead to significant operational disruption, data unavailability, and potential financial losses for organizations relying on rpcx for their services. While no specific victim count or targeted sectors are available, any organization deploying rpcx services through version 1.9.3 is at risk of this easily triggered DoS.

Recommendation

• Patch CVE-2026-59803 immediately by upgrading rpcx to a patched version (1.9.4 or later) or applying commit 047aec1.
• Monitor your rpcx application hosts for sudden spikes in memory usage or unexpected service restarts, which could indicate attempted exploitation of CVE-2026-59803.