Listen to this Post
How the CVE works:
CVE-2025-59789 is a stack overflow vulnerability in Apache bRPC’s json2pb component, affecting versions before 1.15.0. The component uses the rapidjson library to parse JSON data from network requests, such as HTTP+JSON inputs. Rapidjson employs a recursive parsing method by default to handle nested JSON structures. When an attacker sends crafted JSON data with a deeply recursive format—like extensively nested objects or arrays—the parser enters a deep recursion chain. Each recursive call consumes stack memory for function frames and local variables. Without a recursion depth limit, this process continues unchecked. As the recursion depth increases, typically beyond hundreds of levels, the stack memory is exhausted. This leads to a stack overflow condition, where the program cannot allocate more stack space. The overflow causes the bRPC server process to crash abruptly, resulting in a denial of service. The vulnerability is exploitable remotely by targeting bRPC servers that use protobuf messages to serve http+json requests or directly use functions like JsonToProtoMessage on untrusted input. The root cause is the absence of a depth validation mechanism during JSON parsing, allowing uncontrolled recursion until system resources are depleted.
Platform: Apache bRPC
Version: < 1.15.0
Vulnerability: Uncontrolled recursion stack overflow
Severity: Critical
Date: 2025-12-01
Prediction: Patched in v1.15.0
What Undercode Say:
Showing bash commands and codes related to the blog
bash command: ./server –json2pb_max_recursion_depth=100
code snippet: // Vulnerable json2pb call
JsonToProtoMessage(json_input, &proto_msg);
how Exploit:
Send deep recursive JSON data remotely to crash server.
Protection from this CVE:
Upgrade to version 1.15.0. Apply patch 3099. Set depth limit gflag.
Impact:
Denial of service via server crash.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
