Denial-of-Service Vulnerability in rpcx by Smallnest

CVE-2026-59803

What is CVE-2026-59803?

The rpcx library, prior to version 1.9.3, is susceptible to a denial-of-service attack due to inadequate controls in the message decoding process. When handling messages with a compression flag, the payload is decompressed without restrictions on size, which can result in significant heap allocation, potentially exhausting memory resources. This vulnerability allows an unauthenticated user to send a small compressed payload that, when decompressed, can expand to an overwhelming size, leading to out-of-memory errors and disrupting service availability.

References