Executive brief
rpcx is a framework used to build high-performance communication services. A flaw in how it handles compressed data allows an unauthenticated attacker to crash a server by sending a specially crafted, small message that expands to a massive size in memory. This can lead to a total service outage due to the server running out of memory.
Technical details
A denial-of-service vulnerability exists in rpcx's wire protocol decoding logic within `protocol.Message.Decode`. When a message has a compression flag (gzip or snappy) set, the payload is decompressed using `util.Unzip` without any limit on the resulting output size. While `protocol.MaxMessageLength` exists, it only validates the compressed size of the frame on the wire, failing to protect against decompression bombs. Because this decompression occurs during the initial request reading phase before authentication or service lookup, a remote, unauthenticated attacker can trigger massive heap allocations (gigabytes) using a small network request (under 2MB), causing an Out-of-Memory (OOM) crash. The issue is fixed in commit 047aec1 by introducing `MaxDecompressedLength` and `LimitedUnzipper`.
Affected products
- smallnest rpcx <= 1.9.3
Timeline
- 2026-07-07: disclosed: Issue reported on GitHub
- 2026-07-07: patched: Fix merged in commit 047aec1
- 2026-07-08: advisory: CVE published and VulnCheck advisory released