CVE-2026-74755: CWE-191 Integer Underflow (Wrap or Wraparound) in Apache Software Foundation Apache bRPC

CVE-2026-74755 is an integer underflow vulnerability in Apache bRPC's mcpack2pb parser component affecting versions prior to 1.18.0. The UnparsedValue::as_string() function computes `_size - 1` where `_size` is the value_size of a string field from network data. If value_size is zero, this subtraction underflows the unsigned size_t type, resulting in a very large size passed to resize(), which throws a std::length_error exception. Because this exception is not caught during request parsing, the bRPC server process aborts with SIGABRT, leading to a denial of service. The vulnerability specifically affects bRPC servers accepting nshead frames wired to the ubrpc mcpack2 adaptor, such as the NsheadService + UbrpcMcpack2Adaptor deployment pattern. Stock open-source bRPC marks these protocols as client-only, so default server setups are not vulnerable.

Remote attackers can cause a denial of service by crashing the bRPC server process via a crafted request containing a string field with zero value_size. This leads to an uncaught exception and process abort, resulting in service disruption. There is no indication of code execution or data leakage from the provided information.

Upgrade Apache bRPC to version 1.18.0 or later where this issue is fixed. Alternatively, apply the patch available in the pull request https://github.com/apache/brpc/pull/3450. Default server configurations are not affected unless they explicitly accept nshead frames wired to the ubrpc mcpack2 adaptor, so review deployment patterns to assess exposure.