CVE-2025-59789: 
Homebrew vulnerability analysis and mitigation

CVE-2025-59789 is an uncontrolled recursion vulnerability in the json2pb component of Apache bRPC, classified as "Stack Exhaustion via Unbounded Recursion in JSON Parser." It affects all versions of Apache bRPC before 1.15.0 on all platforms, and was disclosed on December 1, 2025 by Wang Weibing via the oss-security mailing list, with credit to Tyler Zars as the finder. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (oss-security, Red Hat CVE).

The root cause is uncontrolled recursion (CWE-674) in the json2pb component, which relies on the rapidjson library for parsing JSON data received from the network. By default, rapidjson uses a recursive descent parsing strategy with no depth limit, meaning a specially crafted JSON payload with deeply nested structures can exhaust the call stack and trigger a stack overflow, crashing the server process. Exploitation requires no authentication or special privileges — an attacker simply sends a deeply nested JSON body to any bRPC HTTP+JSON endpoint, or triggers the vulnerability via direct use of JsonToProtoMessage on untrusted input. The affected functions include ProtoMessageToJson, ProtoMessageToProtoJson, JsonToProtoMessage, and ProtoJsonToProtoMessage (oss-security, Apache Mailing List).

Successful exploitation causes the bRPC server process to crash due to stack overflow, resulting in a complete denial of service (DoS) for all clients relying on that server. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Services using bRPC to handle HTTP+JSON requests from untrusted networks are particularly at risk, as any unauthenticated remote attacker can repeatedly crash the server (oss-security, Red Hat CVE).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.63%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat CVE).

1. Reconnaissance: Identify internet-facing bRPC servers configured to serve HTTP+JSON requests using protobuf messages, using network scanning tools or service fingerprinting.
2. Craft malicious payload: Construct a deeply nested JSON object (e.g., hundreds or thousands of levels of nested objects or arrays) that exceeds the default stack depth of the target system.
3. Send the payload: Submit the crafted JSON payload via an HTTP POST request to any bRPC endpoint that accepts JSON-encoded protobuf messages (e.g., Content-Type: application/json).
4. Trigger stack overflow: The json2pb component passes the payload to rapidjson's recursive parser, which recurses until the call stack is exhausted, causing a stack overflow and crashing the server process.
5. Repeat for sustained DoS: Since no authentication is required, the attacker can repeatedly send such payloads to keep the service unavailable (oss-security).

• Network: Unusual HTTP POST requests to bRPC endpoints with abnormally large or deeply nested JSON bodies; repeated requests from the same source IP causing server restarts.
• Logs: bRPC server logs showing abrupt process termination or crash signals (e.g., SIGSEGV, stack overflow errors) correlated with incoming HTTP+JSON requests; application logs indicating repeated service restarts.
• Process: Unexpected termination of the bRPC server process; operating system crash dumps or core files generated by the bRPC process indicating stack overflow.

The primary remediation is to upgrade Apache bRPC to version 1.15.0, which introduces a recursion depth limit (default: 100) for the affected JSON/protobuf conversion functions. Alternatively, apply the patch from the official GitHub pull request at https://github.com/apache/brpc/pull/3099. After applying either fix, if legitimate requests contain JSON or protobuf messages with nesting depth exceeding 100, adjust the json2pb_max_recursion_depth gflag accordingly. As an additional defense-in-depth measure, implement network-level filtering or API gateways to validate and limit JSON payload complexity from untrusted sources (oss-security, Apache Mailing List).

The vulnerability received coverage from several cybersecurity news outlets including GBHackers, CyberSecurityNews, and SecurityOnline shortly after disclosure, with articles highlighting the crash risk for high-performance systems using Apache bRPC. The Hacker News weekly recap also referenced the vulnerability. Community discussion on Reddit's CVEWatch listed it among top trending CVEs for the week of December 1, 2025. Red Hat tracked the vulnerability in their CVE database, and it was included in CISA's weekly vulnerability summary (GBHackers, The Hacker News, Red Hat CVE).