CVE-2026-74757: CWE-770 Allocation of Resources Without Limits or Throttling in Apache Software Foundation Apache bRPC

The vulnerability exists in the mcpack2pb parser of Apache bRPC before version 1.18.0. The parser uses the item count from the mcpack array header to preallocate memory for repeated protobuf fields without verifying that the count matches the actual payload size. An attacker can send a request with an item count set to a large value (e.g., 0x7fffffff), causing the server to preallocate approximately 16GB of virtual memory. This uncontrolled allocation can cause the server process to abort (SIGABRT) on hosts with limited memory. The issue affects bRPC servers that use NsheadService wired to UbrpcMcpack2Adaptor and parse requests with code generated by the mcpack2pb protoc plugin. The request body is parsed before authentication, increasing exposure.

Remote attackers can cause denial of service by forcing the server to allocate excessive memory, potentially leading to process crashes due to resource exhaustion. This can disrupt service availability on affected Apache bRPC servers.

A fix is available. Users should upgrade Apache bRPC to version 1.18.0 or later, which includes a patch that caps the array item count to the remaining bytes of the array payload, preventing excessive memory allocation. Alternatively, users can apply the patch provided in the linked pull request (https://github.com/apache/brpc/pull/3451).