SQL injection in itsourcecode Online Cake Ordering System 1.0 lets an authenticated low-privileged remote user manipulate the prcd argument submitted to /inserttrans.php and alter backend database queries, with publicly available exploit code but no confirmed active exploitation (not listed in CISA KEV). The assessed CVSS 3.1 impact is low across confidentiality, integrity, and availability, and practical risk is further limited because this is a narrowly deployed tutorial application.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows an authenticated low-privileged remote user to manipulate the ID argument of /deletecustomer.php and alter database queries. Publicly available exploit code exists, but the application is a niche tutorial-style system rarely deployed in production, so the realistic priority is LOW despite remote reachability. The weakness is limited to low confidentiality, integrity, and availability impact and requires valid credentials before exploitation.
SvelteKit (@sveltejs/kit) before 3.0.0 can send a victim's browser to an attacker-controlled site when an enhanced form action (use:enhance) accepts an action path beginning with // and a non-redirect form result is used for navigation. The issue is a client-side open redirect (CWE-601) requiring a crafted link or form action plus victim interaction, and it does not compromise the SvelteKit server or expose application data; only off-site navigation is possible. No public exploit code was identified at time of analysis, and the CVSS v4 score is 2.1.
There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated /snapshot or /screen endpoint returning JPEGs
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76529 are related to improper protection of alternate path and are grouped under the Common Weakness Enumeration (CWE) CWE-424.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76528 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76527 are related to improper check or handling of exceptional conditions and are grouped under the Common Weakness Enumeration (CWE) CWE-703.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76408 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76407 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails. A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated. Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.
Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts. connect reports success as soon as ssh_connect returns SSH_OK. libssh leaves the known-hosts check to the application, and this binding never makes it, so the strict_hostkeycheck and knownhosts options are set on the session and then decide nothing. Password, agent and public-key authentication, channel and SFTP operations all run on a session whose peer was never identified, so an attacker who can redirect the connection receives the password when password authentication is used, and commands and data sent over the session.
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The failure shift is cached for each pair of trie state and text character in a field of the matcher object, and nothing clears it. A character not seen before at a given state adds an entry that lasts for the life of the matcher. An attacker who can submit text with many distinct characters to a long-lived matcher can grow its memory with each search.
Out-of-bounds read in Pillow's TIFF encoder before 13.0.0 can disclose process memory or crash the application when TIFF tag values are inconsistent with the actual image data. The issue is not triggered by simply opening a malicious image; exploitation requires an application to save a TIFF using attacker-influenced tag metadata, and the assessed vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) reflects that high precondition. The Pillow 13.0.0 release notes rank it High severity, but no CISA KEV listing, EPSS score, or public exploit code was provided, so no public exploit identified at time of analysis.
Multiple integer overflows in musl libc's regcomp() allow a crafted regular-expression pattern to produce undersized heap allocations and out-of-bounds writes. Any application that compiles attacker-supplied regexes through musl 0.5.0 through 1.2.6 is exposed - notably Alpine Linux, OpenWrt, and embedded musl-linked builds - with a predictable crash as the readily achievable outcome and code execution possible only in application-specific heap/concurrency conditions. Exposure requires unauthenticated remote input reaching regcomp(); no public exploit code and no CISA KEV entry were identified at time of analysis, so quantitative exploitation signals (CVSS, EPSS, KEV, POC) are entirely absent and the risk must be weighed qualitatively.
Unbounded resource retention in PowerDNS Recursor lets remote clients drive memory exhaustion by repeatedly opening and closing DNS-over-TCP connections. Recursor 5.3.x before 5.3.12 and 5.4.x before 5.4.8 retain entries for closed TCP client addresses until process exit, so the effect is cumulative over long uptimes and can degrade or deny DNS service; the independent assessment is availability-only (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). No public exploit code or CISA KEV entry was identified at time of analysis.
PowerDNS Recursor releases before 5.3.12 and 5.4.8 can be tied up by a client that opens a connection to the built-in web server/REST API and never completes the TLS handshake, leaving the single web handler occupied and denying web/API access to legitimate users. The flaw is one of seven issues fixed in PowerDNS Security Advisory 2026-12 (tracked as CVE-2026-85557) and only matters where the web server is enabled and reachable, since it is disabled or bound to loopback by default; DNS resolution, cache integrity and DNSSEC validation are unaffected. No public exploit code, EPSS score or CISA KEV listing was provided, and no vendor CVSS vector accompanies this specific CVE, so the recorded impact is limited to availability of the web interface (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
PowerDNS Recursor can have its EDNS Client Subnet (ECS) hardening bypassed by a crafted EDNS OPT pseudo-record whose owner name is not the root label, weakening the intended ECS restrictions rather than directly enabling code execution or full cache poisoning. The issue affects 5.3.x releases before 5.3.12 and 5.4.x releases before 5.4.8, and exploitation is only meaningful where incoming ECS handling is enabled (for example use-incoming-edns-subnet), a non-default deployment mode. No public exploit code, KEV entry, or EPSS score was provided; our independent assessment is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, and no public exploit was identified at time of analysis.
DNSSEC validation bypass and cache poisoning in PowerDNS Recursor lets remote, unauthenticated attackers inject forged DNS records into a validating resolver's cache by abusing the out-of-band NS resolution path, where delegation and NS data obtained during recursion is accepted without adequate DNSSEC validation (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - integrity-only impact, high attack complexity). Affected are the 5.3.x train prior to 5.3.12 and the 5.4.x train prior to 5.4.8; the flaw is only practically reachable when an attacker can induce the recursor to resolve a name in a zone whose authoritative responses they control or spoof, for example by luring a client query for an attacker-chosen domain. No public exploit code or confirmed active exploitation was identified at time of analysis, and the EPSS score was not available in the supplied data, but the integrity impact on DNSSEC-validating deployments makes this the highest-priority item in advisory SA-2026-12.
Denial of service in PowerDNS Recursor 5.3.x before 5.3.12 and 5.4.x before 5.4.8, where a crafted DNS packet containing malicious name-compression pointers can drive runaway decompression of DNS names and exhaust the recursor's CPU, degrading or halting resolution service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High). Unauthenticated remote attackers can trigger it either by sending the packet straight to a reachable recursor port or by luring the recursor into resolving a name hosted on an attacker-controlled authoritative server that returns the malformed response - so open or internet-reachable resolvers carry the most risk, while recursors restricted to trusted internal clients are far less exposed. The flaw ships as part of PowerDNS Security Advisory 2026-12, a seven-CVE bundle whose most serious member (CVE-2026-85555) is a DNSSEC validation bypass and cache poisoning; no CVSS vector, EPSS score, KEV listing or public exploit code was present in the source data, so no quantitative exploitation signal is available and the assessment rests on the vendor advisory text alone (no public exploit identified at time of analysis).
Out-of-bounds read in PowerDNS Recursor's findScopeZero routine affects releases prior to 5.3.12 and 5.4.8 and is reachable by unauthenticated remote clients only when the non-default use-incoming-edns-subnet option is enabled and a scope-zero answer is produced for a query. Triggering the flaw yields limited information exposure and a plausible denial of service via process crash, reflected in the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L vector, where the high attack complexity stems from the narrow configuration and answer-shape prerequisites rather than attacker-side effort. No public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis, so exploitation has not been observed and quantitative risk signals are absent; this CVE is one of six issues bundled in PowerDNS Security Advisory 2026-12 and is among the lower-severity members of that set.
TCP connection exhaustion in PowerDNS Recursor lets a remote client drive the resolver to hold excessive numbers of sockets in TIME_WAIT state, degrading or blocking further DNS-over-TCP service. The flaw affects Recursor release trains 5.3.x before 5.3.12 and 5.4.x before 5.4.8 and is one of seven CVEs bundled in PowerDNS Security Advisory 2026-12, where it is rated Medium/Low rather than High. No authentication is needed (assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), impact is limited to availability with no effect on data integrity or confidentiality, and no public exploit code or active exploitation was identified at time of analysis; no EPSS or KEV data was supplied.
The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix route than the one authenticated, which allows a remote attacker with the target HMAC to gain that higher-privileged route's toolsets.
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions. The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.
Remote unauthenticated denial of service affects Apache bRPC versions before 1.18.0 when the optional RTMP service is enabled, where a single crafted RTMP Abort control message that names the chunk stream currently being parsed triggers a heap use-after-free and crashes the server. Exploitation requires the non-default ServerOptions.rtmp_service configuration and network reachability to the RTMP listener; with that precondition, no credentials, user interaction, or application-level request are needed. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis.
A single unauthenticated request can abort an Apache bRPC server (versions before 1.18.0) that has been explicitly configured to accept nshead frames through the ubrpc mcpack2 adaptor, because an integer underflow in UnparsedValue::as_string() turns a zero-length string field into a SIZE_MAX resize() call whose uncaught std::length_error terminates the process with SIGABRT. Per the independent assessment this rates CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, but the reachable surface is non-default: stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so only deployments following the NsheadService + UbrpcMcpack2Adaptor pattern are exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability - no code execution or data exposure is described.
TLS endpoint impersonation in Apache bRPC before 1.18.0 allows an on-path attacker who can redirect or intercept a client Channel connection to present a CA-trusted certificate for a different identity and impersonate the intended TLS server, affecting confidentiality and integrity. The flaw is only reachable when client-side TLS peer verification (VERIFY_PEER) is enabled, the connection crosses an untrusted network, and the client trusts a CA capable of issuing certificates for other names; HTTPS Channels that verify the URL host are not affected. No public exploit was identified at time of analysis, and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
Remote denial of service affects Apache bRPC deployments before 1.18.0 when built on platforms where plain char is unsigned, notably ARM64. Unauthenticated attackers can send a crafted request URI containing a high-bit byte (0x80-0xFF) to an HTTP server, triggering out-of-bounds reads in URL parsing; the case-insensitive header-name lookup is also reachable through APIs that process untrusted header names, such as the HTTP/2 HPACK path, and the result can be a process crash. x86_64 builds with signed plain char are not affected, and no public exploit identified at time of analysis.
Memory exhaustion denial of service in Apache bRPC before 1.18.0 allows remote unauthenticated peers to push buffered message data past the configured max_body_size limit when the service uses non-progressive HTTP/1, non-progressive HTTP/2, memcache, or couchbase parsing paths. The assessed vector is network-reachable, low-complexity, unauthenticated denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability. No public exploit was identified at time of analysis, and progressive HTTP reading is not affected because it uses bounded buffering.
Memory and CPU exhaustion in Apache bRPC's Redis-protocol handler lets remote unauthenticated clients inflate server resource usage by sending long inline commands that never terminate with CRLF. The parser sizes its allocation from the current connection buffer and copies the whole buffer before it has located the inline command boundary, because the redis_max_allocation_size guard was enforced only for RESP bulk strings and arrays, not for the inline path. Every bRPC release before 1.18.0 is affected when the optional Redis protocol is enabled and reachable by untrusted clients; impact is limited to denial of service (availability only), with no code execution or data disclosure reported. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a low-complexity, unauthenticated network trigger.
Out-of-bounds write in Apache bRPC's Redis RESP parser allows remote unauthenticated attackers who can reach a bRPC server with ServerOptions.redis_service enabled to send an empty RESP array header followed by a bulk string, causing a parser memory corruption and process crash. The independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with exploitation limited by the opt-in Redis service and by non-default fatal-log behavior that must fail to abort before the indexed write. No CISA KEV entry or public exploit code was identified at time of analysis, and Apache bRPC 1.18.0 contains the fix.
Memory exhaustion in Apache bRPC's RTMP AMF parser allows unauthenticated remote attackers to consume excessive resources on servers that opt into the RTMP component. Versions before 1.18.0 accept attacker-declared long-string lengths and array element counts without first confirming the payload contains enough bytes, so a small AMF message can force oversized allocations before parsing fails. RTMP is not enabled by default, and no public exploit has been identified at time of analysis.
Denial of service in Apache bRPC before 1.18.0 allows an unauthenticated remote RTMP peer to crash the bRPC process by sending deeply nested AMF objects or arrays, exhausting the native stack. Exploitation is limited to deployments that use bRPC's RTMP support and parse AMF data from untrusted peers, such as RTMP servers handling client command messages or RTMP clients handling server responses, metadata, or cue points. No CISA KEV confirmation or public exploit code was identified at time of analysis.
Remote denial of service in Apache bRPC (versions before 1.18.0) allows a malicious, compromised, or faulty Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply, driving the reply parser into unbounded recursion until the stack is exhausted. Applications that use bRPC as a Redis client with ChannelOptions.protocol="redis" and that accept replies from an untrusted or tampered-with Redis peer are affected, while deployments that only ever connect to trusted, operator-controlled Redis instances are effectively not exposed. No authentication or user interaction on the client is required to trigger the crash once a crafted reply is delivered; no public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis.
Remote unauthenticated denial of service in Apache bRPC before 1.18.0 allows attackers to exhaust the server thread stack by sending a crafted HTTP/2 header block containing many consecutive HPACK Dynamic Table Size Update entries, potentially crashing or hanging the process. The root cause is uncontrolled recursion (CWE-674) in bRPC's built-in HPACK decoder, reachable when the built-in HTTP/2 server accepts traffic from untrusted networks. No public exploit code was identified at time of analysis, and the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is limited to availability.
Apache bRPC through 1.17.0 can treat an HTTP/1.1 keep-alive connection as authenticated after a builtin HTTP request is sent as the first message, allowing remote unauthenticated attackers to bypass authentication for protected non-builtin HTTP endpoints when ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener. The Apache project identifies 1.18.0 as the fixed release and provides a patch PR; no public exploit code was identified at time of analysis.
Apache IoTDB 2.0.0 through 2.0.10 allows an authenticated user with SYSTEM-level privileges (USE_PIPE or MAINTAIN) but no WRITE_DATA or DELETE_DATA grants to execute data loading and deletion as the hardcoded SUPER_USER root identity via crafted PipeData messages on the Legacy Pipe receiver protocol. This bypasses the database permission model and can cause high integrity and availability impact on targeted databases. No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires network access to the Legacy Pipe API plus a valid low-privileged account.
Missing authentication in Apache IoTDB 2.0.0 through 2.0.10 exposes a security-critical function to unauthenticated remote invocation, giving attackers high confidentiality and integrity impact (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) while availability remains unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, but any network-reachable pre-2.0.11 IoTDB service should be treated as at risk. Apache has released 2.0.11 to address the missing authentication control.
Uncontrolled resource consumption in the IoTDB JDBC Driver (versions 1.3.3 through 2.0.10) can let attacker-influenced database responses or endpoints exhaust resources in the client application that integrates the driver, degrading or denying availability on that host. The flaw is client-side, so exposure requires an application to use the affected driver to establish IoTDB connections; the Apache advisory does not name the exact triggering feature. No public exploit code or CISA KEV entry was identified at time of analysis, and the assessed impact is limited to availability (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
Authentication bypass in Apache IoTDB's Thrift RPC service allows remote, unauthenticated attackers who can reach the RPC endpoint to bypass credential checks and access protected database operations, with the independent assessment rating confidentiality, integrity, and availability impact as high. The flaw affects Apache IoTDB 2.0.0 through 2.0.10 and is fixed in 2.0.11; no public exploit code or CISA KEV entry is identified at time of analysis. Risk is concentrated on instances exposing the Thrift RPC port, default TCP 6667, beyond trusted application tiers.
Denial of service in Apache bRPC through 1.17.0 lets a remote attacker abort the server process by sending a single crafted HTTP/2 header block that overruns the HPACK decoder's dynamic-table slot accounting. Because the h2 parser runs on the shared listening port before any Authenticator check, no credentials are needed whenever an h2/gRPC-enabled port is reachable from an untrusted network; 121 minimal 33-byte entries fit inside the 4096-byte byte budget but exceed the 120 available ring-buffer slots, tripping CHECK(!_header_queue.full()) and terminating the process. Impact is availability-only (no disclosure or modification), the condition is removed in bRPC 1.18.0, and no public exploit identified at time of analysis.
Remote unauthenticated denial of service in Apache bRPC's HPACK decoder can abort the server process when a peer sends a crafted HTTP/2 header block. bRPC through 1.17.0 is affected because the default 4096-byte HPACK dynamic table allocates about 120 ring-buffer slots while eviction is tracked by bytes, allowing 121 minimal 33-byte entries to fill the queue and trip a CHECK assertion on the next AddHeader. The h2 parser is enabled by default and runs before authentication, so any exposed HTTP/2 or gRPC listener is at risk; no public exploit code was identified at time of analysis, and 1.18.0 fixes the issue.
Remote denial of service in Apache bRPC through 1.17.0: a peer speaking HTTP/2 or gRPC over the h2 protocol can abort the server process by filling the HPACK dynamic table's fixed-size ring buffer. Because the table is sized for a 34-byte entry while the true minimum entry is 33 bytes, 121 minimal header entries (121 x 33 = 3993 bytes) fit within the default 4096-byte table without triggering byte-usage-based eviction, and the 121st insertion trips CHECK(!_header_queue.full()) and kills the process. The h2 parser is enabled by default on every bRPC port and HPACK decoding happens before any Authenticator check, so exposure to an untrusted network is the only precondition; there is no data exposure or code execution, only availability loss (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No CISA KEV entry, no public exploit code, and no EPSS score were provided with this record, so active exploitation status is unconfirmed and no public exploit was identified at time of analysis.
Unauthenticated remote attackers can abort an Apache bRPC process (versions through 1.17.0) by sending a single small HTTP/2 HEADERS block that over-fills the HPACK dynamic table's fixed-size ring buffer, tripping a CHECK(!_header_queue.full()) assertion that terminates the server. Because the h2 parser is enabled by default on every bRPC server port and decodes header blocks before any Authenticator runs, no credentials, user interaction, or non-default configuration are required - the default 4096-byte table is enough to reach the abort. The issue is fixed in bRPC 1.18.0 (upstream patch PR #3462); no public exploit code or confirmed active exploitation was identified at time of analysis, and no CVSS, EPSS, or KEV data was supplied alongside the advisory.
Remote denial of service in Apache bRPC through 1.17.0 allows attackers to crash servers or exhaust memory by sending crafted HTTP/2 (h2) frames to the default-enabled h2 parser, which processes peer-controlled stream and header metadata before authentication. The vendor advisory describes remote unauthenticated exploitation; the assessed impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or CISA KEV entry was identified at time of analysis.
A crafted HPACK header block can abort Apache bRPC 1.17.0 and earlier that serve HTTP/2 (h2) or gRPC on a network-reachable port. The default 4096-byte HPACK dynamic table is sized for 34-byte entries, so only about 120 ring-buffer slots exist while eviction is driven by byte usage; 121 minimal 33-byte headers (3,993 bytes total) are therefore accepted without evicting anything, and the 121st insertion trips CHECK(!_header_queue.full()) and terminates the process. The flaw is availability-only and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) because decoding happens before any Authenticator runs; it is fixed in bRPC 1.18.0, and no CISA KEV listing, EPSS score, or public exploit code was supplied in the input data, so no public exploit has been identified at time of analysis.
A single crafted HTTP/2 HEADERS block can abort an Apache bRPC process (versions through 1.17.0) that serves h2 or gRPC traffic from an untrusted network, giving remote attackers a repeatable, low-cost denial of service. The h2 parser runs on every bRPC server port and decodes HPACK header blocks before any Authenticator check, so no credentials are required (PR:N per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector, availability impact only). The input contained no CISA KEV entry, no EPSS score, and no public exploit code, so there is no public exploit identified at time of analysis and active exploitation is not confirmed; the fix ships in Apache bRPC 1.18.0, which bundles 35 security fixes.
Remote unauthenticated denial of service in Apache bRPC through 1.17.0 lets a network peer crash an HTTP/2 or gRPC (h2) server by sending a crafted sequence of minimal HPACK header entries. The default 4096-byte HPACK dynamic table is allocated as 120 slots based on a 34-byte entry size, while the true minimum entry is 33 bytes, so 121 minimal entries fit within the byte cap without triggering eviction and then hit a full-header-queue CHECK that aborts the process. No authentication or user interaction is required; bRPC 1.18.0 and upstream patch PR #3462 correct the sizing, and no public exploit code or CISA KEV entry was identified in the provided data.
Remote denial of service in Apache bRPC 1.17.0 and earlier allows unauthenticated network peers to drive disproportionate memory consumption or abort the process by sending input whose declared or decompressed size is never validated. Five parser paths are affected: gzip/zlib/snappy decompression (only the compressed body is counted against -max_body_size, so a 64 MiB cap-compliant body can expand to tens of GiB), AMF string readers that allocate the wire-declared length before the bytes arrive, RTMP chunk headers that re-declare a message length mid-stream into an ever-growing reassembly buffer, the unbounded meta_size field of the sofa-pbrpc parser, and mcpack2pb, which reserves on wire-declared item counts and underflows its buffer size when a string value_size is 0, triggering an abort. The flaw is fixed in 1.18.0 and no public exploit code was identified at time of analysis; reachability is limited to deployments that actually accept compressed bodies or rtmp/sofa-pbrpc/mcpack2pb traffic from untrusted clients, since these parsers run before any Authenticator check.
Remote unauthenticated denial of service in Apache bRPC through 1.17.0: a peer can fill the HTTP/2 HPACK dynamic-table ring buffer with 121 minimal 33-byte header entries that stay within the 4096-byte byte budget but exceed the 120-slot queue, triggering CHECK(!_header_queue.full()) and aborting the process. Any bRPC server exposing h2 or gRPC to an untrusted network is affected because HPACK decoding happens before any Authenticator check. No public exploit code was identified at the time of analysis; this is one of 35 flaws fixed in bRPC 1.18.0.