EUVD-2026-42372
GHSA-hgrm-22x6-r8c8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed rpcx port
-
DeliveryCraft <2MB gzip bomb frame
-
ExploitSet compression flag, send unauthenticated
-
ExecutionServer decompresses in readRequest
-
PersistHeap expands to gigabytes
-
ImpactOOM crashes service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | Exploitation requires that the target run an rpcx server (through 1.9.3) reachable over the network and accepting the rpcx binary wire protocol; the attacker must set the message compression flag so the payload is routed through util.Unzip/gzip decompression in protocol.Message.Decode. No authentication, credentials, or user interaction are needed because decoding and decompression occur in readRequest before the authentication stage (CVSS PR:N/UI:N), and the compressed frame simply needs to stay under protocol.MaxMessageLength (under ~2 MB) while expanding to gigabytes. The main limiting factors are network reachability of the rpcx port and that the deployment must accept compressed messages; there is no default-off toggle described, so standard rpcx servers exposed to untrusted networks are exploitable. |
| Impact | The signals are internally consistent and point to a genuine, easy-to-trigger availability risk rather than a paper-high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:N/VA:H) correctly reflects remote, unauthenticated, low-complexity exploitation with pure availability impact and no confidentiality or integrity loss - matching the description exactly. Publicly available exploit code plus a straightforward, deterministic trigger (a single crafted packet) raises practical exploitability, and pre-authentication reachability means no credentials limit attacker access. No EPSS score or CISA KEV entry was provided, so this is not confirmed as actively exploited - the risk is high likelihood of successful DoS if targeted, not evidence of ongoing campaigns. Note the supplied Tags include 'Information Disclosure,' which conflicts with the CVSS (VC:N) and the description: this is a denial-of-service issue, not information disclosure - the tag appears mislabeled and should be disregarded. |
| Exploit ScenarioDerived | An attacker crafts a gzip 'bomb' - a highly compressible payload (e.g. gigabytes of repeated bytes) that compresses to under 2 MB - wraps it in an rpcx protocol frame with the compression flag set, and sends it over a single TCP connection to any exposed rpcx server without authenticating. The server decompresses it in readRequest, allocates gigabytes of heap, and is killed by the OOM condition, taking down the service. Publicly available exploit code lowers the effort required to reproduce this. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Uncontrolled resource consumption in the smallnest rpcx Go RPC framework (through 1.9.3) lets a single unauthenticated client crash the server by sending a small (<2 MB) gzip-compressed protocol message that decompresses into gigabytes of heap. Because protocol.Message.Decode inflates the payload via util.Unzip during readRequest - before any authentication - and the only size guard (protocol.MaxMessageLength) is checked against the compressed frame rather than the decompressed output, the server exhausts memory and becomes unavailable. Publicly available exploit code exists and a vendor patch (commit 047aec1) has been released; no public evidence of active exploitation at time of analysis.
RemediationAI
Upstream fix available (commit 047aec1); a released, tagged patched version was not independently confirmed from the provided data, so update to the first rpcx release that includes commit 047aec18efa7d037105e2b72c36dd2ae05e1acc6 (merged via PR #943) - pin to that commit or later if a semver tag beyond 1.9.3 is not yet published. Rebuild and redeploy all services that embed the rpcx library, since this is a compiled-in dependency rather than a standalone appliance. If immediate patching is not possible, apply compensating controls: place rpcx endpoints behind network ACLs or a firewall so only trusted peers can connect (trade-off: breaks open/public RPC exposure); enforce strict per-process memory limits via cgroups/container memory caps with automatic restart so an OOM degrades to a brief restart rather than a host-wide outage (trade-off: connections drop during restart); and where feasible disable or reject compressed messages at the protocol layer (trade-off: loses bandwidth savings for legitimate large payloads). See the VulnCheck advisory (https://www.vulncheck.com/advisories/rpcx-denial-of-service-via-gzip-decompression-bomb-in-wire-protocol) and PR https://github.com/smallnest/rpcx/pull/943 for fix details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rpcx is a popular Go-based RPC framework (github.com/smallnest/rpcx) with its own binary wire protocol defined in protocol/message.go. Each frame carries flags including a compression bit; when set, the payload is gzip-decompressed through util.Unzip. The root cause maps to CWE-409 (Improper Handling of Highly Compressed Data / 'decompression bomb'): gzip is streamed into an unbounded in-memory buffer with no ceiling on output size. The one built-in guard, protocol.MaxMessageLength, only bounds the compressed on-the-wire length, so a tiny compressed frame that satisfies the check can still inflate by orders of magnitude. Critically, decode/decompression happens in readRequest before the authentication stage, removing any trust barrier in front of the amplification primitive.
Know when Rpcx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity trigger before auth (AV:N/AC:L/PR:N/UI:N) with pure availability impact via OOM; no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.
Executive ViewAI
The smallnest rpcx Go framework (versions through 1.9.3) contains a denial-of-service vulnerability that allows anyone with network access to crash running services, potentially impacting all organization systems relying on this framework. Because no authentication is required and the attack payload is tiny, any exposed rpcx service is at risk of being disabled by attackers. A vendor patch is available and must be deployed immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB