Apache bRPC CVE-2026-54425

Exploitation requires that the target run bRPC's BUILT-IN HTTP/2 implementation and accept HTTP/2 traffic from an untrusted network - this is the specific prerequisite named in the advisory's affected scenario. The trigger is a single HTTP/2 header block containing many consecutive HPACK Dynamic Table Size Update entries; no authentication, credentials, or user interaction are described as necessary. Limiting factors that reduce real-world exposure: deployments that do not expose bRPC's HTTP/2 server to untrusted clients (e.g., internal-only service meshes behind an HTTP/2-terminating proxy that normalizes HPACK), that use a different protocol, or that have upgraded to 1.18.0 / applied PR #3343 are not exploitable. Impact is confined to availability (worker thread/process stack exhaustion); no data exposure or code execution is indicated.

This is a remote, pre-authentication denial-of-service flaw (CWE-674, uncontrolled recursion) in the HTTP/2 HPACK decoder of Apache bRPC before 1.18.0. No CVSS vector or score is provided in the input (CVSS: N/A), so severity cannot be anchored to an official base score; based on the description the impact is availability-only (thread stack exhaustion) with no confidentiality or integrity loss. There is no CISA KEV listing and no public exploit identified in the provided data, and no EPSS score was supplied, so exploitation-probability signals are absent - meaning there is no evidence of active or widespread exploitation at this time. The real-world risk is moderate: the trigger (a crafted HTTP/2 header block with many consecutive Dynamic Table Size Update entries) is simple to construct and requires no authentication, but the blast radius is limited to service availability and is contingent on the deployment actually exposing bRPC's built-in HTTP/2 server to untrusted networks. Net: a legitimate patch-worthy DoS for internet- or untrusted-network-facing bRPC HTTP/2 endpoints, but not a high-urgency compromise risk - prioritize behind any RCE/credential issues. Note explicitly: CVSS and EPSS data are MISSING from the input, so the assessment below relies on the vendor description rather than scored intelligence.

An attacker with network reachability to a bRPC service using the built-in HTTP/2 implementation sends a single crafted HTTP/2 request whose header block contains a long run of consecutive HPACK Dynamic Table Size Update entries. The recursive decoder invokes itself once per update, exhausting the worker thread's stack before any header field or end-of-input is reached, crashing the handling thread or process and denying service. No public proof-of-concept is identified in the provided data, but the attack requires no authentication and only a correctly formatted HTTP/2 frame.