CVE-2026-59803

Name of the Vulnerable Software and Affected Versions rpcx versions prior to 1.9.3

Description A denial-of-service issue exists in the protocol.Message.Decode() function (protocol/message.go). When a message has the compression flag set, the payload is decompressed using util.Unzip without a limit on the output size. The protocol.MaxMessageLength guard only checks the compressed frame length, failing to protect against decompression bombs. Since this process occurs in readRequest before authentication, an unauthenticated connection can send a small gzip-compressed message that expands into gigabytes of heap allocation, causing out-of-memory conditions and service unavailability.

Recommendations Update to the version containing commit 047aec1.