CVE-2026-59803 Details
Description
rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.
A denial-of-service vulnerability has been identified in rpcx versions through 1.9.3. The issue arises in the 'protocol.Message.Decode' function, where gzip-compressed messages are decompressed without any limit on the output size. This flaw allows a single unauthenticated connection to send a small compressed message that expands to gigabytes of memory allocation, causing out-of-memory conditions and service unavailability. The vulnerability occurs before authentication, exploiting the fact that the only size guard in place is checked against the compressed length, not the decompressed size.
Users can update to rpcx version 1.9.4 or later, where this vulnerability has been fixed. Instructions for updating can be found in the rpcx repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/smallnest/rpcx/commit/047aec18efa7d037105e2b72c36dd2ae05e1acc6 | [email protected] | Source CodeVendor |
| https://github.com/smallnest/rpcx/issues/942 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/smallnest/rpcx/pull/943 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/rpcx-denial-of-service-via-gzip-decompression-bomb-in-wire-protocol | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| smallnest rpcx | <= 1.9.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |