# CVE-2026-82230: Apache bRPC uncontrolled recursion in mcpack2pb parser

Source: https://junglewise.ai/threats/cve-2026-82230-uncontrolled-recursion-in-the-mcpack2pb-component-in-apache-brpc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-82230 · Severity: info · Published 2026-10-21

Apache bRPC is an open-source RPC framework used for distributed computing. A parser flaw allows remote attackers to crash bRPC servers handling deeply nested data structures by exploiting unlimited recursion in message parsing. This causes denial of service to applications relying on bRPC for communication.

Technologies: [Apache Brpc](https://junglewise.ai/threats/technologies/brpc). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82230 being exploited in the wild.

**How severe is CVE-2026-82230?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Brpc < 1.18.0.

**Is there a fix for CVE-2026-82230?** Yes: fixed in bRPC 1.18.0. Until then: Configure request filtering to reject mcpack messages with nesting depth exceeding 128 levels, or restrict mcpack/ubrpc/public_pbrpc endpoints to trusted networks until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82230 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82230?** Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in bRPC 1.18.0

Configure request filtering to reject mcpack messages with nesting depth exceeding 128 levels, or restrict mcpack/ubrpc/public_pbrpc endpoints to trusted networks until upgrading.

## Technical details

The mcpack2pb parser in bRPC recursively processes nested objects and arrays without enforcing a depth limit. When a protobuf message contains self-referential or repeated fields, an attacker can send specially crafted mcpack data with extreme nesting depth to exhaust the stack and crash the process. The vulnerability affects servers using recursive-schema protobuf messages to handle nshead_mcpack, ubrpc, or public_pbrpc requests from untrusted networks.

## Affected products

- Apache bRPC < 1.18.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://github.com/](https://github.com/)
- [https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb](https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb)

## Related threats

- [Apache bRPC MySQL client null pointer dereference](https://junglewise.ai/threats/cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a)
- [Apache bRPC Discovery naming-service JSON parsing crash](https://junglewise.ai/threats/cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions)
- [brpc Server authentication bypass via internal_port](https://junglewise.ai/threats/cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and)
- [Apache bRPC path traversal and resource exhaustion in builtin services](https://junglewise.ai/threats/cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource)
- [Apache bRPC HTTP request/response smuggling in bundled parser](https://junglewise.ai/threats/cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request)