Apache bRPC EUVD-2026-107217

Exploitable only when the bRPC server (version < 1.18.0) is configured to serve nshead_mcpack, ubrpc, or public_pbrpc requests AND uses a recursive/self-referential protobuf message schema (e.g. a repeated message field that references its own type), with that endpoint reachable from an untrusted network. Given those conditions, exploitation is remote and unauthenticated (PR:N) with no user interaction and low complexity - a single deeply nested mcpack request crashes the process. Limiting factors: servers not using the mcpack2pb-backed protocols above, or not using a recursive-schema message, are not vulnerable; the fix (v1.18.0) enforces MAX_DEPTH=128, so legitimate requests nested deeper than 128 levels will also be rejected after patching.

This is a straightforward availability-only denial-of-service issue (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), confirming remote, unauthenticated, low-complexity triggering with no confidentiality or integrity impact. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis' (the referenced apache/brpc PR #3499 is a fix, not weaponized exploit code). The real-world risk is tempered by a significant precondition that the raw CVSS does not capture: the crash only occurs when a bRPC server is configured with a recursive-schema protobuf message serving nshead_mcpack/ubrpc/public_pbrpc protocols from an untrusted network - deployments not using those protocols or recursive schemas are not affected. The 7.5 score is therefore accurate for the worst case but overstates risk for typical deployments. This is a genuine but conditional DoS, not a high-CVSS-but-no-real-risk theoretical: a vulnerable, exposed server can be crashed trivially. Priority should be moderate - patch promptly where the affected protocols are exposed, lower urgency otherwise.

A bRPC service exposing nshead_mcpack/ubrpc/public_pbrpc endpoints with a self-referential (recursive) protobuf message schema is reachable from an untrusted network. An attacker sends a single crafted mcpack payload containing thousands of nested objects/arrays; the generated parser recurses once per level, exhausts the stack, and crashes the worker process, denying service to legitimate clients. No authentication or user interaction is required, and no public exploit code is currently identified.