Apache bRPC CVE-2026-74757

Exploitation requires the server to be deployed in the Baidu ubrpc pattern - a NsheadService wired to UbrpcMcpack2Adaptor that parses incoming requests using code generated by the mcpack2pb protoc plugin; stock bRPC servers not using this adaptor are not affected. Given that config, no authentication is needed because the request body is parsed before authentication (per the advisory), and the trigger is a single crafted mcpack request whose array header declares an oversized item count (e.g., 0x7fffffff). Limiting factors: the vulnerable mcpack2pb/ubrpc wiring is non-default, and the process abort (SIGABRT) realistically materializes only on memory-constrained hosts or those with restrictive memory-overcommit limits, since the 16GB is preallocated virtual memory.

This is an availability-only denial-of-service issue (CWE-770, uncontrolled resource allocation) with limited corroborating signals: no CVSS score or vector is provided in the input, no EPSS probability is available, the CVE is not listed in CISA KEV, and no public exploit code is referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' The advisory (Apache mailing-list thread) states the mcpack request body is parsed before authentication, which raises exposure for any server running the affected deployment pattern; however, the impact is confined to memory exhaustion that 'may abort the process (SIGABRT) on memory-constrained hosts,' so the worst case is a crash/DoS rather than code execution or data compromise. Two factors materially lower real-world priority despite the pre-auth reach: (1) exploitation requires the specific, non-default Baidu ubrpc wiring (NsheadService + UbrpcMcpack2Adaptor + mcpack2pb-generated parsing code), not a stock bRPC server; and (2) the ~16GB figure is virtual-memory preallocation, so the crash is conditional on host memory limits/overcommit settings. Net: a legitimate patch-worthy bug for the narrow set of deployments using the ubrpc pattern, but not a broad high-risk emergency. NOTE: because no CVSS vector was supplied, authentication requirements cannot be confirmed from a scored vector; the 'parsed before authentication' claim comes from the advisory description only.

A remote attacker sends a single crafted mcpack request to a bRPC server exposing the ubrpc (NsheadService/UbrpcMcpack2Adaptor) endpoint, setting the array header's item count to a huge value such as 0x7fffffff. The mcpack2pb-generated parser trusts that count and calls Reserve() to preallocate roughly 16GB for a repeated protobuf field, exhausting memory and potentially aborting the process (SIGABRT) before authentication occurs. No public proof-of-concept is referenced, but the trigger is a simple malformed request requiring no privileges.