rpcx implements a wire‑protocol decoder that decompresses gzip payloads into resulting data. The protocol.Message.Decode method uses util.Unzip to decompress any payload marked with the compression flag, and the only check against a maximum size is performed against the compressed frame length, not the inflated size. As a result, an attacker can send a tiny compressed input that expands to gigabytes of heap data, exhausting memory and causing the process to crash or become unresponsive. This flaw is classified as a resourceCWE‑409).

The flaw is present in all releases of smallnest rpcx up to and including version 1.9.3. The fix is implemented in commit 047aec18efa7d037105e2b72c36dd2ae05e1acc6; any deployment that incorporates this commit is no longer vulnerable. Deployments that have not applied the commit remain affected.

According to the CVSS entry, the vulnerability scores 8.7. The EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog. It can be exploited remotely before any authentication is performed anof-memory condition can be triggered on a single node or within a container, rendering the service unavailable for legitimate users.