{"id":"CVE-2026-59803","title":"rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol","summary":"rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with n…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-409"],"vendor":"smallnest","product":"rpcx","affected":["rpcx <= 1.9.3"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-07-09T13:29:48.308645Z"},"exploitAvailable":true,"published":"2026-07-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:07:23.595Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59803","references":[{"url":"https://github.com/smallnest/rpcx/issues/942","label":"Researcher Disclosure"},{"url":"https://github.com/smallnest/rpcx/pull/943","label":"Fix PR"},{"url":"https://github.com/smallnest/rpcx/commit/047aec18efa7d037105e2b72c36dd2ae05e1acc6","label":"Fix Commit"},{"url":"https://www.vulncheck.com/advisories/rpcx-denial-of-service-via-gzip-decompression-bomb-in-wire-protocol"}],"tags":["cve.org","exploit-available"],"epss":0.00742,"epssPercentile":0.54936,"ingestedAt":"2026-11-08T14:51:22.279Z","slug":"CVE-2026-59803","body":"## Overview\n\nrpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.\n\n## Affected\n\n- `rpcx <= 1.9.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}