Apache bRPC CVE-2026-82425

The target must be a bRPC server (version < 1.18.0) serving HTTP/2, h2, or gRPC on a port reachable from an untrusted network - this is the default-enabled configuration on every bRPC server port. The malicious HPACK header block is processed during HPACK decoding before any Authenticator check runs, so no credentials are required. The specific trigger is a header block adding 121 minimal 33-byte dynamic-table entries that stay under the default 4096-byte eviction threshold. Limiting factors: exploitation requires the attacker to reach the h2/gRPC port and the server to be running an affected version (≤1.17.0); deployments exposing only non-h2 protocols, or already on 1.18.0 / patched with PR #3462, are not affected.

No CVSS vector, EPSS score, KEV listing, or POC indicator was provided in the input, so quantitative exploitation signals are entirely absent and this assessment rests on the vendor advisory text alone. Based on that description, the real-world risk profile is a classic remote, unauthenticated denial-of-service: a peer sending a crafted HPACK header block over HTTP/2 or gRPC can add 121 minimal 33-byte dynamic-table entries that stay under the 4096-byte eviction threshold, driving the 121st AddHeader into CHECK(!_header_queue.full()) and deliberately aborting (crashing) the process. The h2 parser is enabled by default on every bRPC server port and runs before any Authenticator check, so there are no mitigating authentication or configuration prerequisites - this is a genuine availability priority for any bRPC deployment exposed to untrusted HTTP/2 traffic, not a high-CVSS-but-low-real-risk paper issue. The impact is bounded to availability only (process crash); there is no indication of confidentiality or integrity impact or code execution. The advisory is one of 35 bRPC vulnerabilities disclosed together, several of which (CVE-2026-78058, -78066) describe related unauthenticated resource-exhaustion/crash vectors in the same receive path, reinforcing that the h2 attack surface is broadly reachable. No evidence of active exploitation or public exploit code exists in the provided data; the publicly posted fix PR (#3462) does document the crash mechanism in detail, which lowers the bar for a researcher to reproduce it.

An attacker with network access to a bRPC server's HTTP/2 or gRPC port sends a single crafted HEADERS frame containing 121 minimal (33-byte) HPACK dynamic-table entries, each a 1-byte name with an empty value. Because eviction is driven by byte usage rather than slot count, these entries never evict but overflow the 120-slot ring buffer, and the 121st insertion trips a CHECK assertion that aborts the process. No authentication, user interaction, or special configuration is required; no public exploit code is identified, though the fix PR describes the triggering mechanism.