CVE-2026-59803 smallnest CVE debrief

Who should care

Users of rpcx through version 1.9.3 should be aware of this vulnerability and take steps to mitigate it. This includes updating to a version of rpcx that includes the fix, such as commit 047aec1, and implementing compensating controls to detect and prevent exploitation.

Technical summary

The vulnerability exists in the protocol.Message.Decode function in protocol/message.go. When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.

Defensive priority

High

Recommended defensive actions

• Update to a version of rpcx that includes the fix, such as commit 047aec1.
• Implement compensating controls to detect and prevent exploitation, such as monitoring for unusual traffic patterns and limiting the size of incoming messages.
• Verify that the rpcx service is properly configured and that the fix has been applied.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-08T20:16:55.913Z and was last modified on 2026-07-10T18:46:32.250Z. The NVD entry is currently Deferred. The vulnerability was reported by Vulncheck and is described in their advisory.

Official resources