CVE-2026-82230: CWE-674 Uncontrolled Recursion in Apache Software Foundation Apache bRPC
Description
CVE-2026-82230 is an uncontrolled recursion vulnerability in the mcpack2pb component of Apache bRPC versions prior to 1.18.0. It allows remote attackers to crash the server by sending deeply nested mcpack data, causing stack overflow due to unbounded recursive parsing. The issue affects bRPC servers handling nshead_mcpack, ubrpc, or public_pbrpc requests with recursive protobuf schemas. The vulnerability is fixed in version 1.18.0, which enforces a maximum parsing depth limit of 128. Requests with nesting deeper than this limit will be rejected after the fix.
Affected software
Apache Software Foundation
Apache bRPC
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache bRPC versions before 1.18.0 contain a vulnerability in the mcpack2pb parser where recursive parsing of nested protobuf messages lacks a depth limit. This allows an attacker to send deeply nested mcpack data that causes unbounded recursion, leading to stack overflow and server crash. The vulnerability specifically impacts servers using recursive-schema protobuf messages to serve nshead_mcpack, ubrpc, or public_pbrpc requests from untrusted networks. The issue is resolved in version 1.18.0 by enforcing a MAX_DEPTH limit of 128 on parsing, preventing excessive recursion.
Potential Impact
Remote attackers can cause a denial of service by crashing the Apache bRPC server through sending specially crafted deeply nested mcpack data. This results in stack overflow due to uncontrolled recursion in the parser. There is no indication of code execution or data leakage from the provided information.
Mitigation Recommendations
Upgrade Apache bRPC to version 1.18.0 or later, which includes an official fix enforcing a maximum parsing depth limit. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3499. After applying the fix, requests with nesting deeper than 128 levels will be rejected, preventing the stack overflow crash.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-28T09:18:29.085Z
- State
- PUBLISHED
Threat ID: 6ad8b1502cdf04f656ecd9bc
Added to database: 10/21/2026, 12:34:24 UTC
Last enriched: 10/21/2026, 12:49:44 UTC
Last updated: 10/21/2026, 12:49:45 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.