Remote denial of service in Apache bRPC through 1.17.0 allows an unauthenticated HTTP/2 or gRPC peer to abort the server process by sending a header block that compresses into 121 minimal 33-byte HPACK entries. Because the default 4096-byte dynamic table evicts based on byte usage (121 x 33 = 3993 bytes, still under the cap) while its ring buffer is sized for only 120 slots, the 121st AddHeader trips CHECK(!_header_queue.full()) and terminates the process. No public exploit code or CISA KEV listing was identified at time of analysis, but the h2 HPACK decoder runs on the shared server port before any Authenticator check, so every reachable h2/gRPC listener on an affected version is exposed without credentials or user interaction.
Missing authentication in Apache bRPC through 1.17.0 allows remote attackers to bypass the configured Authenticator on deployments that expose the streaming RPC path to untrusted networks. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, so the impact is limited to low confidentiality and integrity effects with no availability impact. The issue is fixed in bRPC 1.18.0; no public exploit code or CISA KEV entry was identified in the available data, and the supplied CVE description is truncated, so exact triggering conditions should be confirmed against the full Apache advisory.
Unauthenticated remote attackers can crash an Apache bRPC server running version 1.17.0 or earlier by sending a crafted HPACK header block that fills the decoder's dynamic-table ring buffer past its capacity, tripping an internal CHECK() assertion and aborting the process. The flaw affects any bRPC deployment that exposes an HTTP/2 or gRPC (h2) listener to an untrusted network, since HPACK decoding happens before any Authenticator check and the h2 parser is enabled by default on bRPC ports. Impact is limited to availability (process termination); no code execution or data exposure is described, and no public exploit code was identified at time of analysis. This is one of 35 fixes bundled into the bRPC 1.18.0 security release, which also addresses related h2 resource-consumption and decompression issues.
Unauthenticated remote attackers can abort Apache bRPC 1.17.0 and earlier servers that expose HTTP/2 or gRPC (h2) listeners by sending a header block that fills the HPACK dynamic table's ring buffer without triggering byte-based eviction. The flaw is a slot-accounting mismatch in the HPACK decoder: the default 4096-byte table is provisioned for 34-byte entries, but 33-byte minimal entries permit 121 insertions before the fixed-size ring buffer overflows, tripping CHECK(!_header_queue.full()) and terminating the process. No public exploit code was identified at time of analysis; the independent assessment rates this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), availability-only, with exploitation requiring only network reachability to a default-configured h2/gRPC port because HPACK decoding occurs before any Authenticator check.
Remote pre-authentication denial of service in Apache bRPC through 1.17.0 lets any network peer that can reach an HTTP/2 or gRPC (h2) listener abort the server process. The HPACK decoder sizes its default 4096-byte dynamic table for 33-byte minimum entries (roughly 120 slots) but evicts only on byte usage, so 121 minimal 33-byte insertions (3993 bytes) fit under the byte cap while exhausting the fixed slot ring buffer; the 121st AddHeader trips CHECK(!_header_queue.full()) and terminates the process. No public exploit identified at time of analysis, and because the h2 parser decodes headers before any Authenticator check, no credentials or user interaction are required.
Remote unauthenticated attackers can crash Apache bRPC 1.17.0 and earlier servers that expose HTTP/2, h2, or gRPC endpoints by sending a crafted HPACK header block that exhausts the dynamic-table ring buffer and triggers an assertion abort. The issue is reachable during HPACK decoding before any Authenticator check, and the assessed CVSS 3.1 score is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis; the vendor released bRPC 1.18.0 and an upstream patch in PR #3462.