Uncontrolled Resource Allocation in Apache bRPC's mcpack2pb Component

CVE-2026-74757

What is CVE-2026-74757?

The mcpack2pb component in Apache bRPC prior to version 1.18.0 is susceptible to an uncontrolled resource allocation vulnerability. This flaw allows remote attackers to exploit the mcpack request handling mechanism by sending a crafted request that contains a disproportionately large array item count. The parser fails to properly validate this count against the actual payload size, resulting in excessive memory allocation. An attacker can trigger significant memory consumption, potentially leading to application crashes, especially on systems with limited memory resources. To mitigate this risk, users are advised to upgrade to version 1.18.0 or apply the provided patch, which ensures that the array item count is capped to fit the actual payload size.

References