{"id":"CVE-2025-59789","summary":"Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser","details":"Uncontrolled recursion in the json2pb component in Apache bRPC (version \u003c 1.15.0) on all platforms allows remote attackers to make the server crash via sending deep recursive json data.\n\nRoot Cause:\nThe bRPC json2pb component uses rapidjson to parse json data from the network. The rapidjson parser uses a recursive parsing method by default. If the input json has a large depth of recursive structure, the parser function may run into stack overflow.\n\nAffected Scenarios:\nUse bRPC server with protobuf message to serve http+json requests from untrusted network. Or directly use JsonToProtoMessage to convert json from untrusted input.\n\n\n\nHow to Fix: \n(Choose one of the following options) \n1. Upgrade bRPC to version 1.15.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3099 \n\n\n\nNote:\nNo matter which option \n\nyou choose, you should know that the fix introduces a recursion depth limit with default value 100. It affects these functions: \n\nProtoMessageToJson, ProtoMessageToProtoJson, JsonToProtoMessage, and ProtoJsonToProtoMessage.\n\n If your requests contain json or protobuf messages that have a depth exceeding the limit, the request will be failed after applying the fix. You can modify the gflag json2pb_max_recursion_depth to change the limit.","modified":"2026-08-12T03:51:39.603962832Z","published":"2025-12-01T10:22:41.697Z","database_specific":{"cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59789.json","unresolved_ranges":[{"extracted_events":[{"fixed":"1.15.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"apache"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/12/01/1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59789.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/ozmcsztcpxn61jxod8jo8q46jo0oc1zx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59789"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/brpc","events":[{"introduced":"0"},{"fixed":"50a9075de62f1d2b825b902acbfecfddb3d9f314"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.15.0"}]}}],"versions":["1.13.0","1.0.0","1.0.0-rc02","1.0.0-rc01","0.9.8-rc01","0.9.7-rc02","0.9.7-rc03","0.9.7","0.9.7-rc01","0.9.6-rc03","0.9.6-rc02","0.9.6-rc01","0.9.6","0.9.5","v0.9.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59789.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}