An integer underflow occurs inside the mcpack2pb parser when handling string fields with a zero value_size. The UnparsedValue::as_string() function subtracts one from the provided size without validation, causing an unsigned underflow when the size is zero. The resulting resize() call throws std::length_error which propagates up the request parsing path and terminates the server process with SIGABRT. This allows a remote attacker to send a single unauthenticated request that immediately crashes the bRPC server, rendering it unavailable to legitimate traffic and constituting a denial‑of‑service condition.

The vulnerability affects Apache bRPC components on all platforms with versions earlier than 1.18.0. bRPC servers that accept nshead frames wired to the ubrpc mcpack adaptor—such as deployments using NsheadService plus UbrpcMcpack2Adaptor—are susceptible. Stock open‑source bRPC defaults register the ubrpc/nshead_mcpack protocols as client‑only, so configurations that do not expose these server endpoints are not impacted by the flaw.

The flaw can be exploited remotely by crafting a request containing a string field whose size is zero. No authentication is required, and there are no environmental prerequisites beyond the vulnerable protocol being exposed. The CVSS score is 7.5, indicating a high severity denial‑of‑service vector. The EPSS score is <1%, and the issue is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet but the potential for undisclosed use remains. Organizations running affected bRPC instances should assume the risk is significant enough to warrant immediate remedial action.