# CVE-2025-59789: Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote…

Source: https://junglewise.ai/threats/cve-2025-59789-uncontrolled-recursion-in-the-json2pb-component-in-apache-brpc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01  
License: CC BY 4.0 with a link back

CVE-2025-59789 · Severity: high · CVSS 7.5 · Published 2025-12-01

Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote attackers to make the server crash via sending deep recursive json data.

Root Cause:
The bRPC json2pb component uses rapidjson to parse json data from the network. The rapidjson parser uses a recursive parsing method by default. If the input json has a large depth of recursive structure, the parser function may run into stack overflow.

Affected Scenarios:
Use bRPC server with protobuf message to serve http+json requests from untrusted network. Or directly use JsonToProtoMessage to convert json from untrusted input.



How to Fix: 
(Choose one of the following options) 
1. Upgrade bRPC to version 1.15.0, which fixes this issue.
2. Apply this patch:  https://github.com/apache/brpc/pull/3099 



Note:
No matter which option 

you choose, you should know that the fix introduces a recursion depth limit with default value 100. It affects these functions: 

ProtoMessageToJson, ProtoMessageToProtoJson, JsonToProtoMessage, and ProtoJsonToProtoMessage.

 If your requests contain json or protobuf messages that have a depth exceeding the limit, the request will be failed after applying the fix. You can modify the gflag json2pb_max_recursion_depth to change the limit.

Technologies: [Apache Brpc](https://junglewise.ai/threats/technologies/brpc). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2025-59789 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59789 being exploited in the wild.

**How severe is CVE-2025-59789?** High severity, with a CVSS score of 7.5, published 1 December 2025.

**Which products and versions are affected?** Apache Brpc. The advisory does not name versions.

**Is there a fix for CVE-2025-59789?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-59789?** Check whether you run Apache Brpc. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Apache Brpc

## Related threats

- [Apache bRPC MySQL client null pointer dereference](https://junglewise.ai/threats/cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a)
- [Apache bRPC Discovery naming-service JSON parsing crash](https://junglewise.ai/threats/cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions)
- [brpc Server authentication bypass via internal_port](https://junglewise.ai/threats/cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and)
- [Apache bRPC path traversal and resource exhaustion in builtin services](https://junglewise.ai/threats/cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource)
- [Apache bRPC HTTP request/response smuggling in bundled parser](https://junglewise.ai/threats/cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request)