CVE-2026-74755

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value size. The UnparsedValue::as string() function computes size - 1 without validating size; when value size is 0 the expression underflows to SIZE MAX, resize() throws std::length error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).

Root Cause: In src/mcpack2pb/parser.cpp, UnparsedValue::as string() resizes the output string to size - 1, where size is the value size of a string field taken directly from the network data. A value size of 0 underflows the unsigned size t, and the subsequent resize() throws an exception that is not caught.

Affected Scenarios: bRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor (for example the NsheadService + UbrpcMcpack2Adaptor deployment pattern) can be crashed by a single unauthenticated request. Stock open-source bRPC registers the ubrpc/nshead mcpack protocols as client-only, so default server configurations are not affected.

How to Fix: