The vulnerability stems from uncontrolled recursion in the mcpack2pb parser used by Apache bRPC. When a recursive protobuf schema is parsed, the parser recurses once per nesting level without any depth limit, causing a stack overflow and crashing the server. This weakness is identified as CWE‑674. The result is denial of service, as the process terminates and availability is lost; confidentiality or integrity are not directly compromised.

Apache bRPC versions earlier than 1.18.0 on all platforms are affected. Any deployment that handles nshead_mcpack, ubrpc, or public_pbrpc requests from untrusted networks and uses a recursive protobuf schema is vulnerable.

An attacker can exploit this flaw by sending a deeply nested mcpack message over the network to the exposed bRPC service; authentication requirements are not specified in the CVE data. The absence of a depth check makes the attack trivial to execute and will inevitably crash the process. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the potential for widespread denial-of-service exploitation remains high.