Apache bRPC CVE-2026-82210

Requires a bRPC server (version ≤ 1.17.0) serving HTTP/2 or gRPC via the h2 protocol and reachable from an untrusted network; the h2 parser is enabled by default on every bRPC server port and processes the malicious HPACK header block before any Authenticator check, so no credentials, user interaction, or non-default configuration are needed. The specific prerequisite is that HPACK dynamic-table insertion occurs during decoding of attacker-supplied HEADERS - exploitation is limited only by whether the bRPC h2/gRPC listener is exposed to untrusted peers and by the affected version range (1.18.0 is not vulnerable).

This is a remote, unauthenticated denial-of-service (process crash) in Apache bRPC's HPACK decoder: the dynamic header table sizes its ring buffer by byte usage (_max_size/34 ≈ 120 slots for the default 4096-byte table) while eviction is also driven by byte usage, so 121 minimal 33-byte entries (121*33 = 3993 ≤ 4096) fit without eviction and the 121st AddHeader trips CHECK(!_header_queue.full()), aborting the process. No CVSS, EPSS, KEV, or POC data was supplied with the input, so quantitative exploitation-likelihood signals are entirely MISSING and cannot be compared. On the qualitative signals that ARE present, risk is meaningfully elevated: the advisory states the h2 parser is enabled by default on every bRPC server port and runs before any Authenticator check, making this reachable pre-authentication from an untrusted network, and the trigger is a small deterministic header block requiring no special timing or race. Impact is availability-only (clean process abort, no code execution or data exposure implied). Net: a real, easy-to-trigger crash DoS against exposed HTTP/2/gRPC bRPC endpoints, but its practical priority is bounded by bRPC's specialized deployment footprint and by the absence of any confirmed in-the-wild exploitation - treat as a high-priority patch for anyone exposing bRPC h2 to untrusted peers, not a mass-exploitation emergency. Note: this record is labeled CVE-2026-82210 but the advisory references CVE-2026-78048 for the same HPACK issue - reconcile the identifier with the vendor advisory.

An attacker who can reach a bRPC server's HTTP/2 (h2) or gRPC port over an untrusted network sends a single crafted HEADERS frame whose HPACK block adds 121 minimal 33-byte dynamic-table entries. During HPACK decoding - performed before any authentication - the 121st insertion fills the undersized ring buffer and trips a CHECK, aborting the server process. No public exploit is identified at time of analysis, but the condition is deterministic and trivial to reproduce.