A critical security vulnerability in Apache bRPC could allow remote attackers to crash servers by sending malicious JSON data.
The flaw, identified as CVE-2025-59789, affects all versions before 1.15.0 and poses a significant risk to systems exposed to untrusted networks.
The issue exists in the json2pb component, which converts JSON data to the Protocol Buffers format.
This component uses the rapidjson library with recursive parsing. When the server receives JSON data with deeply nested structures, the parser creates multiple recursive function calls that eventually consume all available stack memory, causing the server to crash.
| Field | Information |
|---|---|
| CVE ID | CVE-2025-59789 |
| Severity | Critical |
| Affected Versions | Apache bRPC before 1.15.0 |
| Component | json2pb (JSON to Protocol Buffers converter) |
| Attack Type | Remote Denial of Service |
How Attackers Exploit It
Remote attackers can exploit this vulnerability without authentication by sending specially crafted JSON data with excessive nesting depth.
The attack requires minimal effort and can be executed from anywhere on the network.
Two primary scenarios are vulnerable: bRPC servers processing HTTP+JSON requests from external sources, and applications directly using the JsonToProtoMessage function with untrusted input.
Any organization running Apache bRPC versions older than 1.15.0 is vulnerable, especially those exposing JSON APIs to the internet. The flaw affects all supported platforms and requires no user interaction, making it highly exploitable.
The Apache bRPC team has released version 1.15.0 that resolves this issue. An immediate upgrade is strongly recommended.
For organizations unable to upgrade quickly, a patch is available at the official GitHub repository.
The fix introduces a default recursion depth limit of 100, which may cause legitimate requests with deeply nested JSON to fail.
Administrators can adjust the gflag json2pb_max_recursion_depth parameter to accommodate specific requirements.
This limit applies to four key functions: ProtoMessageToJson, ProtoMessageToProtoJson, JsonToProtoMessage, and ProtoJsonToProtoMessage.
This critical vulnerability demands immediate attention from all Apache bRPC users. The straightforward exploitation method and severe impact make prompt patching essential.
Organizations should assess their exposure, prioritize upgrading to version 1.15.0, and monitor for any failed requests after the fix is applied.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
