Is CVE-2026-74757 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74757 being exploited in the wild.

How severe is CVE-2026-74757?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Apache Brpc versions before 1.18.0.

How is CVE-2026-74757 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-74757?

Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74757: Apache bRPC uncontrolled resource allocation in mcpack2pb

CVE-2026-74757 · Severity: info · Published 2026-10-21

Apache bRPC, an RPC framework used for building distributed services, contains a memory exhaustion vulnerability in its mcpack2pb component. A remote attacker can send a specially crafted request to a vulnerable server and force it to allocate excessive memory (up to 16GB), potentially crashing the service. This attack requires no authentication and can be exploited before any security checks are performed.

Technologies: Apache Brpc. Vendors: Apache.

Quick answers

Is CVE-2026-74757 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74757 being exploited in the wild.
How severe is CVE-2026-74757?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Brpc versions before 1.18.0.
Is there a fix for CVE-2026-74757?: Yes: fixed in bRPC 1.18.0. Until then: Apply the patch from https://github.com/apache/brpc/pull/3451 if immediate upgrade to 1.18.0 is not possible. The fix validates array item counts against remaining payload bytes before memory allocation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74757 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-74757?: Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: bRPC 1.18.0

Apply the patch from https://github.com/apache/brpc/pull/3451 if immediate upgrade to 1.18.0 is not possible. The fix validates array item counts against remaining payload bytes before memory allocation.

Technical details

The mcpack2pb protoc plugin parser does not validate the array item count field in the mcpack message header against the actual payload size. An attacker can set item_count to a large value (e.g., 0x7fffffff) to cause the code to preallocate huge memory regions via Reserve(), triggering out-of-memory conditions. The vulnerability affects bRPC servers using NsheadService with UbrpcMcpack2Adaptor that parse untrusted mcpack messages, and the fix caps item counts to remaining payload bytes.

Affected products

Apache bRPC versions before 1.18.0

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.