Threats tagged 'ghsa-9644-97m2-4fc3'

An integer underflow vulnerability exists in the mcpack2pb component of Apache bRPC versions prior to 1.18.0. This flaw allows remote attackers to crash a bRPC server by sending a specially crafted request with a string field having a zero value_size. The vulnerability arises because the UnparsedValue::as_string() function subtracts one from the value_size without validation, causing an underflow and an uncaught exception that aborts the process. Default server configurations are not affected as the vulnerable protocol is registered client-only by default.