Overview
CVE-2025-59789 describes an uncontrolled recursion vulnerability in the json2pb component of Apache bRPC versions prior to 1.15.0. This flaw allows remote attackers to potentially crash a server by sending deeply nested JSON data. Exploiting this vulnerability can lead to a denial-of-service (DoS) condition.
Technical Details
The root cause lies in the way the json2pb component utilizes the rapidjson library to parse incoming JSON data. rapidjson, by default, employs a recursive parsing method. If an attacker crafts a JSON payload with an excessively deep recursive structure, the parsing function can exhaust the server’s stack memory, resulting in a stack overflow and subsequent crash.
Affected scenarios include:
- Use of a bRPC server with protobuf messages handling HTTP+JSON requests from untrusted networks.
- Direct use of
JsonToProtoMessageto convert JSON from untrusted input sources.
CVSS Analysis
As of the publication of this article, a CVSS score has not been assigned for CVE-2025-59789. However, the potential for a denial-of-service attack indicates that it should be considered a serious vulnerability requiring immediate attention.
Possible Impact
A successful exploit of CVE-2025-59789 can lead to:
- Denial of Service (DoS): The target server becomes unavailable, disrupting services for legitimate users.
- System Instability: Repeated crashes can lead to broader system instability and potentially other unforeseen consequences.
Mitigation Steps
There are two recommended methods to address this vulnerability:
- Upgrade bRPC: The most straightforward solution is to upgrade to bRPC version 1.15.0 or later. This version includes a fix for the uncontrolled recursion issue.
- Apply the Patch: If upgrading is not immediately feasible, you can apply the patch available on GitHub: https://github.com/apache/brpc/pull/3099
Important Note: Both the upgrade and the patch introduce a recursion depth limit with a default value of 100. This limit affects the following functions: ProtoMessageToJson, ProtoMessageToProtoJson, JsonToProtoMessage, and ProtoJsonToProtoMessage. If your requests contain JSON or Protobuf messages with a depth exceeding this limit, requests will fail. You can adjust the recursion depth by modifying the json2pb_max_recursion_depth gflag. Carefully assess your application’s requirements before increasing this limit, as it may increase the risk of a denial-of-service attack if set too high.
References
Apache Announcement List
Openwall oss-security Mailing List
bRPC Patch on GitHub