Apache bRPC CVE-2026-80463

Requires a bRPC server at version < 1.18.0 serving HTTP/2 or gRPC over the h2 protocol and reachable from an untrusted network; the h2 parser is enabled by default on every bRPC port. The HPACK decode path runs before any Authenticator check, so the advisory states no authentication is needed (not independently confirmable from a CVSS vector, which is absent). The default 4096-byte HPACK dynamic table is what makes the 121-minimal-entry trigger fit under the eviction threshold; a non-default smaller or larger table changes the exact entry count but not the class of flaw. Limiting factors: the attacker must be able to speak h2/gRPC to an exposed bRPC port, and impact is confined to crashing the process (denial of service) with no data exposure or code execution.

No CVSS vector, EPSS score, or KEV entry was provided with this record, and no POC is referenced, so several standard prioritization signals are missing and must be stated as such rather than assumed. Against that gap, the advisory text is specific: an attacker reachable over the network can send a crafted HTTP/2 HEADERS block that, during HPACK decoding, adds 121 minimal 33-byte dynamic-table entries (121*33 = 3993 <= the default 4096-byte table) without triggering byte-driven eviction, overrunning the ~120-slot ring buffer and hitting CHECK(!_header_queue.full()), which aborts the process. This is a low-complexity, availability-only denial of service (process crash) with no confidentiality or integrity impact and no code execution. My independent assessment is roughly CVSS 7.5 (A:H). Because KEV is not set, this is NOT confirmed as actively exploited; because no EPSS is supplied, widespread-exploitation probability cannot be quantified. Net: a genuine priority for any operator exposing a bRPC h2/gRPC port to untrusted peers, but tempered by availability-only impact and the niche footprint of the affected framework. The source lists CVSS as N/A - the vector below is my own, not a copy of any input score.

An attacker who can reach a bRPC server's HTTP/2 or gRPC (h2) port from an untrusted network sends a single crafted HEADERS frame whose HPACK block inserts 121 minimal (name + empty value) dynamic-table entries. Because eviction is driven by byte usage rather than slot count, the entries fit under the 4096-byte table limit yet overflow the under-sized ring buffer, so the 121st AddHeader trips CHECK(!_header_queue.full()) and aborts the process. No public exploit is identified at time of analysis, and no authentication is needed since HPACK decoding runs before any Authenticator check.