Allocation of Resources Without Limits or Throttling in Apache bRPC - CVE-2026-74757
Published: October 23, 2026
Vulnerability identifier: #VU157348
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74757
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through excessive memory allocation.
The vulnerability exists due to uncontrolled resource allocation in Apache bRPC's mcpack2pb parser and generated protobuf parsing code when trusting an array item count without validating it against the payload size. A remote attacker can send a crafted mcpack request declaring item_count = 0x7fffffff to trigger approximately 16 GB of virtual-memory preallocation through Reserve(), potentially aborting the process on a memory-constrained host.
Affected software
Apache bRPC
How to mitigate CVE-2026-74757
Install security update from vendor's website.
Apache bRPC - update to 1.18.0