Denial of service in Apache bRPC before 1.18.0 allows an unauthenticated remote RTMP peer to crash the bRPC process by sending deeply nested AMF objects or arrays, exhausting the native stack. Exploitation is limited to deployments that use bRPC's RTMP support and parse AMF data from untrusted peers, such as RTMP servers handling client command messages or RTMP clients handling server responses, metadata, or cue points. No CISA KEV confirmation or public exploit code was identified at time of analysis.
Remote denial of service in Apache bRPC (versions before 1.18.0) allows a malicious, compromised, or faulty Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply, driving the reply parser into unbounded recursion until the stack is exhausted. Applications that use bRPC as a Redis client with ChannelOptions.protocol="redis" and that accept replies from an untrusted or tampered-with Redis peer are affected, while deployments that only ever connect to trusted, operator-controlled Redis instances are effectively not exposed. No authentication or user interaction on the client is required to trigger the crash once a crafted reply is delivered; no public exploit code, EPSS score, or CISA KEV listing was identified at time of analysis.
Remote unauthenticated denial of service in Apache bRPC before 1.18.0 allows attackers to exhaust the server thread stack by sending a crafted HTTP/2 header block containing many consecutive HPACK Dynamic Table Size Update entries, potentially crashing or hanging the process. The root cause is uncontrolled recursion (CWE-674) in bRPC's built-in HPACK decoder, reachable when the built-in HTTP/2 server accepts traffic from untrusted networks. No public exploit code was identified at time of analysis, and the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is limited to availability.
Apache bRPC through 1.17.0 can treat an HTTP/1.1 keep-alive connection as authenticated after a builtin HTTP request is sent as the first message, allowing remote unauthenticated attackers to bypass authentication for protected non-builtin HTTP endpoints when ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener. The Apache project identifies 1.18.0 as the fixed release and provides a patch PR; no public exploit code was identified at time of analysis.
Apache IoTDB 2.0.0 through 2.0.10 allows an authenticated user with SYSTEM-level privileges (USE_PIPE or MAINTAIN) but no WRITE_DATA or DELETE_DATA grants to execute data loading and deletion as the hardcoded SUPER_USER root identity via crafted PipeData messages on the Legacy Pipe receiver protocol. This bypasses the database permission model and can cause high integrity and availability impact on targeted databases. No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires network access to the Legacy Pipe API plus a valid low-privileged account.
Missing authentication in Apache IoTDB 2.0.0 through 2.0.10 exposes a security-critical function to unauthenticated remote invocation, giving attackers high confidentiality and integrity impact (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) while availability remains unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, but any network-reachable pre-2.0.11 IoTDB service should be treated as at risk. Apache has released 2.0.11 to address the missing authentication control.
Authentication bypass in Apache IoTDB's Thrift RPC service allows remote, unauthenticated attackers who can reach the RPC endpoint to bypass credential checks and access protected database operations, with the independent assessment rating confidentiality, integrity, and availability impact as high. The flaw affects Apache IoTDB 2.0.0 through 2.0.10 and is fixed in 2.0.11; no public exploit code or CISA KEV entry is identified at time of analysis. Risk is concentrated on instances exposing the Thrift RPC port, default TCP 6667, beyond trusted application tiers.
A crafted HPACK header block can abort Apache bRPC 1.17.0 and earlier that serve HTTP/2 (h2) or gRPC on a network-reachable port. The default 4096-byte HPACK dynamic table is sized for 34-byte entries, so only about 120 ring-buffer slots exist while eviction is driven by byte usage; 121 minimal 33-byte headers (3,993 bytes total) are therefore accepted without evicting anything, and the 121st insertion trips CHECK(!_header_queue.full()) and terminates the process. The flaw is availability-only and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) because decoding happens before any Authenticator runs; it is fixed in bRPC 1.18.0, and no CISA KEV listing, EPSS score, or public exploit code was supplied in the input data, so no public exploit has been identified at time of analysis.
Denial of service in Apache bRPC through 1.17.0 lets a remote attacker abort the server process by sending a single crafted HTTP/2 header block that overruns the HPACK decoder's dynamic-table slot accounting. Because the h2 parser runs on the shared listening port before any Authenticator check, no credentials are needed whenever an h2/gRPC-enabled port is reachable from an untrusted network; 121 minimal 33-byte entries fit inside the 4096-byte byte budget but exceed the 120 available ring-buffer slots, tripping CHECK(!_header_queue.full()) and terminating the process. Impact is availability-only (no disclosure or modification), the condition is removed in bRPC 1.18.0, and no public exploit identified at time of analysis.
Remote denial of service in Apache bRPC through 1.17.0: a peer speaking HTTP/2 or gRPC over the h2 protocol can abort the server process by filling the HPACK dynamic table's fixed-size ring buffer. Because the table is sized for a 34-byte entry while the true minimum entry is 33 bytes, 121 minimal header entries (121 x 33 = 3993 bytes) fit within the default 4096-byte table without triggering byte-usage-based eviction, and the 121st insertion trips CHECK(!_header_queue.full()) and kills the process. The h2 parser is enabled by default on every bRPC port and HPACK decoding happens before any Authenticator check, so exposure to an untrusted network is the only precondition; there is no data exposure or code execution, only availability loss (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No CISA KEV entry, no public exploit code, and no EPSS score were provided with this record, so active exploitation status is unconfirmed and no public exploit was identified at time of analysis.
Remote denial of service in Apache bRPC through 1.17.0 allows an unauthenticated HTTP/2 or gRPC peer to abort the server process by sending a header block that compresses into 121 minimal 33-byte HPACK entries. Because the default 4096-byte dynamic table evicts based on byte usage (121 x 33 = 3993 bytes, still under the cap) while its ring buffer is sized for only 120 slots, the 121st AddHeader trips CHECK(!_header_queue.full()) and terminates the process. No public exploit code or CISA KEV listing was identified at time of analysis, but the h2 HPACK decoder runs on the shared server port before any Authenticator check, so every reachable h2/gRPC listener on an affected version is exposed without credentials or user interaction.
Remote unauthenticated attackers can crash Apache bRPC 1.17.0 and earlier servers that expose HTTP/2, h2, or gRPC endpoints by sending a crafted HPACK header block that exhausts the dynamic-table ring buffer and triggers an assertion abort. The issue is reachable during HPACK decoding before any Authenticator check, and the assessed CVSS 3.1 score is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis; the vendor released bRPC 1.18.0 and an upstream patch in PR #3462.
Remote unauthenticated denial of service in Apache bRPC through 1.17.0: a peer can fill the HTTP/2 HPACK dynamic-table ring buffer with 121 minimal 33-byte header entries that stay within the 4096-byte byte budget but exceed the 120-slot queue, triggering CHECK(!_header_queue.full()) and aborting the process. Any bRPC server exposing h2 or gRPC to an untrusted network is affected because HPACK decoding happens before any Authenticator check. No public exploit code was identified at the time of analysis; this is one of 35 flaws fixed in bRPC 1.18.0.
A single crafted HTTP/2 HEADERS block can abort an Apache bRPC process (versions through 1.17.0) that serves h2 or gRPC traffic from an untrusted network, giving remote attackers a repeatable, low-cost denial of service. The h2 parser runs on every bRPC server port and decodes HPACK header blocks before any Authenticator check, so no credentials are required (PR:N per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector, availability impact only). The input contained no CISA KEV entry, no EPSS score, and no public exploit code, so there is no public exploit identified at time of analysis and active exploitation is not confirmed; the fix ships in Apache bRPC 1.18.0, which bundles 35 security fixes.