CVE-2026-74755: Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero valuesize. The UnparsedValue::asstring() function computes size - 1 without validating size; when valuesize is 0 the expression underflows to SIZEMAX, resize() throws std::lengtherror, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).

Root Cause: In src/mcpack2pb/parser.cpp, UnparsedValue::asstring() resizes the output string to size - 1, where size is the valuesize of a string field taken directly from the network data. A valuesize of 0 underflows the unsigned sizet, and the subsequent resize() throws an exception that is not caught.

Affected Scenarios: bRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor (for example the NsheadService + UbrpcMcpack2Adaptor deployment pattern) can be crashed by a single unauthenticated request. Stock open-source bRPC registers the ubrpc/nsheadmcpack protocols as client-only, so default server configurations are not affected.

How to Fix: 1. Upgrade bRPC to a version that includes this fix. 2. Apply the patch in PR  https://github.com/apache/brpc/pull/3450