Apache bRPC EUVD-2026-107180

Exploitation requires the target bRPC server (version < 1.18.0) to be explicitly configured to accept nshead frames wired to the ubrpc mcpack2 adaptor - specifically the NsheadService + UbrpcMcpack2Adaptor deployment pattern. This is a non-default, operator-enabled configuration: stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so default server deployments are not exploitable. When that adaptor IS enabled, no authentication or user interaction is needed - a single crafted request with a zero value_size string field triggers the crash. The primary limiting factor is thus the non-default server configuration; secondary limits are the version ceiling (fixed in 1.18.0 / PR #3450) and that impact is confined to availability (process abort), with no code execution or data exposure.

This is a moderate-severity denial-of-service issue whose real-world risk is sharply constrained by deployment configuration rather than by raw reachability. No CVSS vector, EPSS score, KEV listing, or POC is present in the input, so quantitative exploitation-probability signals are entirely absent and cannot be compared - this assessment rests on the description and CWE-191 alone. The flaw is remotely triggerable by a single unauthenticated request (one crafted mcpack2 string field with value_size=0 underflows to SIZE_MAX in UnparsedValue::as_string(), causing an uncaught std::length_error and SIGABRT), which argues for network-facing severity. However, the vendor explicitly states that stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so DEFAULT server builds are NOT affected - only servers deliberately wired to NsheadService + UbrpcMcpack2Adaptor are exposed. Impact is limited to availability (process abort); there is no confidentiality or integrity loss and no indication of RCE. Net: treat as a real priority only for the subset of operators who have enabled the nshead/mcpack2 server adaptor; for everyone else on default configurations this is a high-CVSS-shaped-but-low-real-exposure issue. No conflicting signals were found, but the near-total absence of exploitation telemetry (no EPSS/KEV/POC) means prioritization should be driven by whether the vulnerable adaptor is actually deployed.

An attacker who can reach a bRPC server that has been configured with the NsheadService + UbrpcMcpack2Adaptor pattern sends a single unauthenticated nshead/mcpack2 request containing a string field whose value_size is 0. During request parsing, UnparsedValue::as_string() computes _size - 1, underflowing to SIZE_MAX, which makes resize() throw an uncaught std::length_error and aborts the process. No public exploit identified at time of analysis, though the trigger is trivial to reproduce from the description.