CVE-2026-82439

/// Technical description

Description

The DRPC server kept a map from function name to request queue and created an entry the first time a

function name was seen. No code path ever removed an entry: request cleanup removed the request from its

queue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of

the process.

Function names come from the client and are not constrained to functions any topology has registered, so the

number of retained entries is bounded only by the number of distinct names an attacker chooses to send, and

each retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are

required to reach the endpoint.

The retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC

server exhausts its heap.

Mitigation

Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it.

Users who cannot upgrade immediately should configure `drpc.authorizer

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References