Critical Apache bRPC Vulnerability Lets Attackers Crash Servers with Malicious JSON

"Patch your Apache bRPC now! Fix CVE-2025-59789 to prevent server crashes from deeply nested JSON exploits. Update to version 1.15.0 today."

By Content Team

Dec 1, 2025

ON THIS PAGE

A critical security flaw (CVE-2025-59789) in Apache bRPC framework allows remote attackers to crash servers by sending deeply nested JSON data. The vulnerability affects all versions before 1.15.0 and exploits the json2pb component's recursive parsing method, causing stack overflow crashes.

Servers handling HTTP+JSON requests from untrusted networks are particularly at risk. Apache has released version 1.15.0 with a complete fix, plus an official GitHub patch for immediate deployment.

The fix introduces a default recursion depth limit of 100, which administrators can adjust. Security teams should patch immediately to prevent denial-of-service attacks.

Source: Cyber Security News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?