{"metadata": {"vulnerability": "CVE-2026-74755", "count": 13, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-15T06:31:05.828Z", "date_only": false, "value": "2026-08-15T06:31:05.828Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-74755", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-21T11:45:25.658Z", "date_only": false, "value": "2026-10-21T11:45:25.658Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-74755", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-21T11:45:25.658Z", "date_only": false, "value": "2026-10-21T11:45:25.658Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-74755", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T12:17:22Z", "date_only": false, "value": "2026-10-21T12:17:22Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9644-97M2-4FC3", "record": "GHSA-9644-97M2-4FC3", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-21T12:17:22.550Z", "date_only": false, "value": "2026-10-21T12:17:22.550", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-74755", "record": "FKIE_CVE-2026-74755", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-21T12:31:11Z", "date_only": false, "value": "2026-10-21T12:31:11Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9644-97M2-4FC3", "record": "GHSA-9644-97M2-4FC3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-21T17:26:09.825Z", "date_only": false, "value": "2026-10-21T17:26:09.825083Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117480067502094511", "record": "CVE-2026-74755", "field": "creation_timestamp", "uuid": "9bc3a1d8-f29d-47e7-bd26-a122b4a68ae2", "content": "CVE-2026-74755 Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).\nRoot Cause:In src/mcpack2pb/parser.cpp, UnparsedValue::as_string() resizes the output string to `_size - 1`, where `_size` is the value_size of a string field taken directly from the network data. A value_size of 0 underflows the unsigned size_t, and the subsequent resize() throws an exception that is not caught.\nAffected Scenarios:bRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor (for example the NsheadService + UbrpcMcpack2Adaptor deployment pattern) can be crashed by a single unauthenticated request. Stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so default server configurations are not affected.\nHow to Fix:1. Upgrade bRPC to a version that includes this fix.2. Apply the patch in PR  https://github.com/apache/brpc/pull/3450\nhttps://www.cve.org/CVERecord?id=CVE-2026-74755https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb#apache #ApacheSoftwareFoundation #ApachebRPC#CVE_2026_74755#bot", "url": "https://infosec.exchange/users/cve/statuses/117480067502094511"}, {"timestamp": "2026-10-30T17:56:37.339Z", "date_only": false, "value": "2026-10-30T17:56:37.339174Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-74755", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-30T17:56:37.339Z", "date_only": false, "value": "2026-10-30T17:56:37.339174Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-74755", "record": "FKIE_CVE-2026-74755", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-30T17:56:42.592Z", "date_only": false, "value": "2026-10-30T17:56:42.592Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-74755", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T17:56:42.592Z", "date_only": false, "value": "2026-10-30T17:56:42.592Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-74755", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T18:18:12.603Z", "date_only": false, "value": "2026-10-30T18:18:12.603", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-74755", "record": "FKIE_CVE-2026-74755", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T18:32:20Z", "date_only": false, "value": "2026-10-30T18:32:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9644-97M2-4FC3", "record": "GHSA-9644-97M2-4FC3", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-10T19:46:55.047Z", "anchors": {"origin": {"timestamp": "2026-10-21T11:45:25.658Z", "date_only": false, "value": "2026-10-21T11:45:25.658Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-74755", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-21T11:45:25.658Z", "date_only": false, "value": "2026-10-21T11:45:25.658Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-74755", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1756889.389434, "hours": 488.02483039833334, "days": 20.334367933263888, "min_seconds": 1756889.389434, "max_seconds": 1756889.389434, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-21T11:45:25.658Z", "date_only": false, "value": "2026-10-21T11:45:25.658Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-74755", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T19:46:55.047Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}