Apache bRPC CVE-2026-78058

Requires a bRPC server at version <= 1.17.0 that accepts HTTP/2 (h2) or gRPC traffic on a port reachable from an untrusted network; per the advisory the h2 parser is enabled by default on every bRPC server port and executes before any Authenticator check, so no authentication, user interaction, or non-default configuration is needed to reach the vulnerable receive path. bRPC h2/gRPC clients connecting to an untrusted backend are also affected. The practical limiting factors are: the target must be running an affected version and actually serving/parsing h2 traffic, and the impact is confined to denial of service (crash or memory exhaustion) with no data exposure or code execution. The vendor advisory explicitly characterizes the attacker as remote and unauthenticated, but because no CVSS vector was provided in the input, that privilege level is not independently confirmed from structured data.

No CVSS vector or score is provided in the input (both N/A), so attack vector and privilege metrics are inferred from the vendor advisory text rather than confirmed by NVD. EPSS is unavailable, the CVE is not listed in CISA KEV, and no public exploit code was identified - so all three exploitation-likelihood signals are either absent or negative. Against those weak signals, the architectural facts raise genuine concern: the Apache advisory states the h2 parser is enabled by default on every bRPC server port and runs before any Authenticator check, meaning a remote unauthenticated attacker can reach the vulnerable code path on default configurations. However, the technical impact is availability-only (process crash via CHECK abort / NULL deref, or unbounded memory growth / OOM) - there is no confidentiality or integrity impact and no code execution, so this is a denial-of-service bug, not a system-compromise bug. Net assessment: a real patching priority for internet- or untrusted-network-exposed bRPC h2/gRPC services because exploitation is pre-auth and low-complexity, but the ceiling is DoS, and the absence of EPSS/KEV/POC suggests no evidence of active exploitation at time of analysis. Note the advisory text at the top of the input (33-byte minimum entry / 121 AddHeader / PR #3462) describes CVE-2026-78048 and bleeds into this record; the authoritative CVE-2026-78058 content is the HTTP/2 receive-path advisory (PR #3474) - verify scoping against the vendor advisory.

An attacker who can reach a bRPC server's port (h2/gRPC enabled by default) opens an HTTP/2 connection and, without authenticating, sends crafted frames - for example a 1-byte-indexed HPACK 'bomb' amplifying a tiny HEADERS frame ~4000x, an unbounded number of pending streams, or a dynamic-table-size update that desynchronizes the decoder. The server either allocates memory without bound until it is OOM-killed or hits an internal CHECK/NULL-dereference and aborts, taking the service down. No public exploit code was identified, but the advisory describes the trigger mechanics in enough detail to reproduce.