---
id: CVE-2026-74755
title: >-
  Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of
  Service
summary: >-
  An integer underflow in the mcpack2pb component of Apache bRPC (version <
  1.18.0) on all platforms allows remote attackers to crash a bRPC server by
  sending a request containing a string field with a zero value_size. The
  UnparsedValue::a…
severity: none
cwe:
  - CWE-191
vendor: Apache Software Foundation
product: apache/brpc
affected:
  - apache/brpc < 1.18.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T11:45:25.658Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74755'
references:
  - url: 'https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb'
tags:
  - cve.org
ingestedAt: '2026-10-21T12:48:53.764Z'
---

## Overview

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).

Root Cause:
In src/mcpack2pb/parser.cpp, UnparsedValue::as_string() resizes the output string to `_size - 1`, where `_size` is the value_size of a string field taken directly from the network data. A value_size of 0 underflows the unsigned size_t, and the subsequent resize() throws an exception that is not caught.

Affected Scenarios:
bRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor (for example the NsheadService + UbrpcMcpack2Adaptor deployment pattern) can be crashed by a single unauthenticated request. Stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so default server configurations are not affected.

How to Fix:
1. Upgrade bRPC to a version that includes this fix.
2. Apply the patch in PR  https://github.com/apache/brpc/pull/3450

## Affected

- `apache/brpc < 1.18.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.