High · published December 1, 2025
⚡ Just a few layers too deep, and your bRPC server could crash faster than you can say "recursive JSON!" 📉 Think of the json2pb component like a chef trying to make a multi-layer cake. If the chef keeps adding layers without checking if the kitchen can handle it, the whole thing can topple over! An attacker could exploit this uncontrolled recursion to send deeply nested JSON data, causing your server to crash in a spectacular heap. This means your service goes offline, and users are left in the lurch, potentially leading to loss of trust and revenue.
Think of the json2pb component like a chef trying to make a multi-layer cake. If the chef keeps adding layers without checking if the kitchen can handle it, the whole thing can topple over! CVE-2025-59789 arises from the bRPC json2pb component using rapidjson, which recursively parses JSON data. If the JSON structure is too deeply nested, it can lead to a stack overflow, crashing the server.
An attacker could exploit this uncontrolled recursion to send deeply nested JSON data, causing your server to crash in a spectacular heap. This means your service goes offline, and users are left in the lurch, potentially leading to loss of trust and revenue. To patch this issue, upgrade bRPC to version 1.15.0 or apply the fix from this patch: https://github.com/apache/brpc/pull/3099. Remember, this fix introduces a recursion depth limit of 100, so consider checking your JSON data structures to avoid request failures! You've got this! Tackle this vulnerability now, and your server will be safer than a cake with just the right amount of frosting! 🎂🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/brpc | < 1.15.0 | 1.15.0 |