EUVD-2026-107187
GHSA-xp33-gmw5-5ggc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed bRPC h2/gRPC port
-
DeliverySend crafted HPACK HEADERS block
-
ExploitAdd 121 minimal 33-byte entries
-
ExecutionOverflow header-queue ring buffer
-
ImpactTrip CHECK and abort process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a bRPC server (version < 1.18.0) serving HTTP/2 or gRPC over the h2 protocol and reachable from an untrusted network. Per the advisory the h2 parser is enabled by default on every bRPC port and HPACK decoding occurs before any Authenticator check, so no authentication, user interaction, or non-default configuration is required - the only prerequisite is network reachability of an h2/gRPC listener. Limiting factors: services not exposing h2/gRPC, or h2 endpoints restricted to trusted networks, are not reachable by this vector; impact is limited to process crash (availability), not code execution or data exposure. |
| Impact | No CVSS, EPSS, KEV, or POC signals were supplied in the input, so this assessment rests on the vendor advisory text alone. The described flaw is a remote, pre-authentication denial of service: an HPACK dynamic-table accounting error (eviction driven by byte usage rather than slot count) lets a peer add 121 minimal 33-byte entries that overflow the ring buffer and hit CHECK(!_header_queue.full()), which deliberately aborts the server process. Based on the advisory, the realistic vector is network, low complexity, no privileges and no user interaction, but the impact is confined to availability - there is no indication of code execution, memory corruption beyond a controlled abort, or data disclosure. This is therefore a genuine but single-dimension (DoS) issue: trivially triggerable where a bRPC h2/gRPC port is reachable, yet not a confidentiality/integrity threat. Exploitation status: no public exploit identified at time of analysis, and it is not listed in CISA KEV. EPSS is unavailable, so widespread automated exploitation cannot be confirmed or ruled out. Priority should track exposure - high for internet-facing bRPC h2 endpoints, lower for internal-only services - rather than a raw severity number, which is absent here (CVSS N/A must be verified with the vendor/NVD). |
| Exploit ScenarioDerived | An attacker who can reach a bRPC server's HTTP/2 or gRPC (h2) port sends a single crafted HEADERS block containing 121 minimal 33-byte HPACK entries. Because the default 4096-byte dynamic table only provisions ~120 slots while eviction is byte-based, the 121st AddHeader overruns the header-queue ring buffer and trips a CHECK that aborts the process, crashing the server without any authentication. No public exploit code is identified, but the trigger is deterministic and simple to reproduce from the advisory details. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers can crash an Apache bRPC server running version 1.17.0 or earlier by sending a crafted HPACK header block that fills the decoder's dynamic-table ring buffer past its capacity, tripping an internal CHECK() assertion and aborting the process. The flaw affects any bRPC deployment that exposes an HTTP/2 or gRPC (h2) listener to an untrusted network, since HPACK decoding happens before any Authenticator check and the h2 parser is enabled by default on bRPC ports. Impact is limited to availability (process termination); no code execution or data exposure is described, and no public exploit code was identified at time of analysis. This is one of 35 fixes bundled into the bRPC 1.18.0 security release, which also addresses related h2 resource-consumption and decompression issues.
RemediationAI
Vendor-released patch: upgrade Apache bRPC to 1.18.0, the first release containing the corrected dynamic-table sizing logic; alternatively apply the upstream fix from https://github.com/apache/brpc/pull/3462 if a full minor-version upgrade is not immediately possible, though cherry-picking carries its own regression risk and the tagged release is preferred. Because the h2 parser processes header blocks before any Authenticator check, authentication cannot be used as a compensating control. Where immediate upgrade is infeasible, restrict exposure of h2/gRPC listeners: bind bRPC ports to trusted networks or place them behind a network policy/allowlist so only known clients reach HPACK decoding, accepting that this limits legitimate gRPC reachability; or front the service with a proxy that terminates HTTP/2 and enforces a strict SETTINGS_MAX_HEADER_LIST_SIZE and bounded header counts, at the cost of added latency, an extra hop, and requiring the proxy to re-encode header blocks rather than pass them through. Serving only non-h2 protocols on untrusted-facing ports removes the vector entirely but breaks gRPC clients. Upgrading to 1.18.0 additionally enforces default limits introduced alongside this fix (1024 concurrent streams per connection and a 1 MiB decoded header-list size, both raisable via flags) and addresses the related h2 resource-consumption and decompression amplification issues reported in the same advisory batch; operators with legitimate large-header or large-body workloads should validate flag settings (-max_body_size, -max_decompressed_body_size, and the h2 limit flags) after upgrading to avoid new rejections.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue lives in Apache bRPC's HPACK implementation (RFC 7541) used for decoding header blocks on the h2/gRPC receive path. HPACK entries are accounted at name length + value length + 32 bytes of overhead, so the smallest possible entry is 33 bytes; bRPC sized its dynamic-table slot ring buffer using a minimum entry size of 33 (with a rounding quirk yielding roughly 4096/34 = 120 slots for the default 4096-byte table). Eviction in AddHeader is driven by byte accounting (_max_size) rather than slot count, creating a mismatch: a peer can insert 121 minimal 33-byte entries (121 x 33 = 3993 bytes, under the 4096-byte budget) without triggering any eviction, and the 121st insertion then reaches CHECK(!_header_queue.full()) and aborts the process. The defect therefore falls in the reachable-assertion / uncontrolled-resource-consumption class rather than a memory-safety class - it is a bookkeeping inconsistency between two capacity metrics that converts a legal, spec-compliant peer behavior into a fatal process abort. The fix in 1.18.0 sizes the dynamic table for the 33-byte minimum entry (max_size / (32 + 1)) and guarantees at least one ring-buffer slot is retained when max_size is below the minimum entry size, so initialization can no longer fail on malloc(0).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Remote unauthenticated HPACK decode before auth (AV:N/AC:L/PR:N/UI:N) deterministically aborts the process, so A:H with no confidentiality or integrity impact.
Lifecycle Timeline
2Description PRE-NVD
Executive ViewAI
Apache bRPC 1.17.0 and earlier can be terminated by a crafted HTTP/2 header block on exposed h2/gRPC listeners, creating a denial-of-service risk for services that depend on bRPC. Because the h2 parser is enabled by default on bRPC ports, any internet- or partner-facing bRPC deployment may be affected, and leadership should prioritize inventory and exposure reduction while vendor fix availability is validated. No public exploit identified at time of analysis, and the described impact is availability-only with no code execution or data exposure.
No vendor-released patch identified at time of analysis; bRPC 1.18.0 is identified as the security release containing the fix, but validate availability before relying on it. Interim mitigations: restrict HTTP/2/gRPC (h2) listeners to trusted networks, front exposed bRPC services with a proxy or ingress that enforces HPACK header limits and rejects malformed header blocks, enable process supervision and auto-restart with alerting on CHECK() aborts, and segment or rate-limit exposed bRPC services.
Threat Intelligence Overview
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB