CVE-2026-59803

rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.

• CWE-409

• https://github.com/smallnest/rpcx/commit/047aec18efa7d037105e2b72c36dd2ae05e1acc6
• https://github.com/smallnest/rpcx/issues/942
• https://github.com/smallnest/rpcx/pull/943
• https://www.vulncheck.com/advisories/rpcx-denial-of-service-via-gzip-decompression-bomb-in-wire-protocol

Published

Jul 8, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59796In JetBrains TeamCity before 2026.1.2 pipeline modification …8.1
• CVE-2026-59799Improper Privilege Management vulnerability in Apache CloudS…8.8
• CVE-2026-5980A flaw has been found in D-Link DIR-605L 2.13B01. Affected b…8.8
• CVE-2026-598009Router before 0.4.44 contains an OS command injection vulne…9.8
• CVE-2026-598019Router through version 0.4.41 contains an unauthenticated a…9.8
• CVE-2026-59802PasswordPusher before 2.8.1 accepts data URI schemes in URL …8.2
• CVE-2026-59804Midscene Bridge Server through 1.10.3, fixed in commit 86f41…7.6
• CVE-2026-59805Gumroad before 2026.07.06.2 contains a broken access control…7.1
• CVE-2026-59806Gradio before 6.20.0 contains an open redirect and server-si…7.4
• CVE-2026-59807Composio SDK before 0.2.32-beta.283 contains a path validati…8.9
• CVE-2026-59808AVideo through commit 9c39d8c8 contains an authentication by…8.8
• CVE-2026-59809SiYuan before v3.8.0 interpolates secret placeholders into t…4.9