{"id":"CVE-2026-74755","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-74755","generatedAt":"2026-10-28T03:29:58.028Z","title":"An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size.","description":"An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).\n\nRoot Cause:\nIn src/mcpack2pb/parser.cpp, UnparsedValue::as_string() resizes the output string to `_size - 1`, where `_size` is the value_size of a string field taken directly from the network data. A value_size of 0 underflows the unsigned size_t, and the subsequent resize() throws an exception that is not caught.\n\nAffected Scenarios:\nbRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor (for example the NsheadService + UbrpcMcpack2Adaptor deployment pattern) can be crashed by a single unauthenticated request. Stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so default server configurations are not affected.\n\nHow to Fix:\n1. Upgrade bRPC to a version that includes this fix.\n2. Apply the patch in PR  https://github.com/apache/brpc/pull/3450","published":"2026-10-21T12:17:23.000Z","lastModified":"2026-10-26T21:10:00.000Z","status":"Deferred","sourceIdentifier":"security@apache.org","cvss":null,"cwe":["CWE-191"],"affected":[],"epss":{"score":0.00202,"percentile":0.10018,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.00202,"percentile":0.09601}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T12:17:23.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-21T12:17:22.550Z"},"summary":"New CVE, not yet scored."}],"references":[{"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb","source":"security@apache.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74755","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}