CVE-2026-82230

{"id": "CVE-2026-82230", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82230", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-21T15:11:11.863125Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "versions": [{"status": "affected", "version": "0", "lessThan": "1.18.0", "versionType": "semver"}], "packageURL": "pkg:github/apache/brpc", "packageName": "apache/brpc", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}]}], "published": "2026-10-21T13:20:02.970", "references": [{"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "source": "security@apache.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.\n\nRoot Cause:\nThe bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.\n\nAffected Scenarios:\nUse bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3499\n\nNote:\nNo matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix."}, {"lang": "es", "value": "Recursi\u00f3n no controlada en el componente mcpack2pb de Apache bRPC (versiones anteriores a la 1.18.0) en todas las plataformas permite a atacantes remotos provocar la ca\u00edda del servidor mediante el env\u00edo de datos mcpack profundamente anidados.\\n\\nCausa ra\u00edz:\\nEl analizador mcpack2pb de bRPC (utilizado para atender solicitudes nshead_mcpack / ubrpc / public_pbrpc) analiza recursivamente objetos y matrices anidados sin ning\u00fan l\u00edmite de profundidad. Para un mensaje protobuf que se referencia a s\u00ed mismo (p. ej., un campo de mensaje repetido), el analizador generado recurre una vez por cada nivel de anidamiento del objeto mcpack entrante. Una solicitud profundamente anidada hace que la recursi\u00f3n crezca sin l\u00edmite, desborde la pila y provoque la ca\u00edda del proceso.\\n\\nEscenarios afectados:\\nUtilizar un servidor bRPC con un mensaje protobuf de esquema recursivo para atender solicitudes nshead_mcpack / ubrpc / public_pbrpc provenientes de una red no confiable.\\n\\nC\u00f3mo corregir:\\n(Elija una de las siguientes opciones)\\n1. Actualice bRPC a la versi\u00f3n 1.18.0, que corrige este problema.\\n2. Aplique este parche: https://github.com/apache/brpc/pull/3499\\n\\nNota:\\nIndependientemente de la opci\u00f3n que elija, debe saber que la correcci\u00f3n impone el l\u00edmite de profundidad de an\u00e1lisis documentado MAX_DEPTH (128) en la ruta de an\u00e1lisis, el mismo l\u00edmite que ya aplica el serializador. Si sus solicitudes contienen mensajes mcpack anidados a m\u00e1s de 128 niveles, la solicitud fallar\u00e1 despu\u00e9s de aplicar la correcci\u00f3n."}], "lastModified": "2026-10-26T23:10:00.183", "sourceIdentifier": "security@apache.org"}