CVE-2026-74755 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache bRPC servers, particularly those that accept nshead frames wired to the ubrpc mcpack2 adaptor, should assess exposure and prioritize upgrading to Apache bRPC version 1.18.0 or later.

Why it matters

The integer underflow vulnerability in Apache bRPC allows remote attackers to crash the server, and defenders should prioritize upgrading to version 1.18.0 or later to prevent denial-of-service attacks.

• Denial-of-service attacks are possible due to the integer underflow vulnerability
• Unauthenticated requests can crash the bRPC server
• Upgrade to Apache bRPC version 1.18.0 or later is required to prevent exploitation
• Server configurations need to be reviewed to ensure that nshead frames are not wired to the ubrpc mcpack2 adaptor

Technical summary

An integer underflow in the mcpack2pb component of Apache bRPC allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes _size - 1 without validating _size; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT). The root cause is in src/mcpack2pb/parser.cpp, UnparsedValue::as_string() resizes the output string to _size - 1, where _size is the value_size of a string field taken directly from the network data. A value_size of 0 underflows the unsigned size_t, and the bR

Defensive priority

Defenders should prioritize upgrading to Apache bRPC version 1.18.0 or later to prevent denial-of-service attacks.

Recommended defensive actions

• Upgrade to Apache bRPC version 1.18.0 or later
• Review server configurations to ensure that nshead frames are not wired to the ubrpc mcpack2 adaptor
• Monitor for unauthenticated requests that could potentially exploit this vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the integer underflow vulnerability in Apache bRPC. The vulnerability allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.