Apache bRPC CVE-2026-82953

Requires a bRPC server (version <1.18.0) serving HTTP/2 or gRPC over the h2 protocol and reachable from an untrusted network. The condition is satisfied by DEFAULT configuration: the h2 parser is enabled on every bRPC server port and processes the malicious header block during HPACK decoding before any Authenticator check, so no authentication, user interaction, or non-default setting is needed. The specific trigger is an HPACK dynamic table left at its default 4096-byte size (yielding 120 ring-buffer slots) into which the peer inserts 121 minimal 33-byte entries. Limiting factor: the target must expose an h2/gRPC endpoint to the attacker; pure HTTP/1 or non-h2 bRPC deployments are not reachable via this path.

This is a remote, unauthenticated denial-of-service affecting Apache bRPC through 1.17.0 in its HTTP/2 HPACK decoder. No CVSS vector, EPSS score, or KEV status is provided in the input, so quantitative exploitation-probability signals are unavailable and cannot be compared. Exploitation status is 'no public exploit identified at time of analysis'; however, the advisory contains a precise, step-by-step reproduction (121 minimal 33-byte dynamic-table entries totalling 3993 bytes, staying under the 4096-byte _max_size so eviction never fires, driving the ring buffer full and tripping CHECK(!_header_queue.full())), which lowers the barrier to building a working trigger even though no weaponized code is published. The impact is availability-only (process abort) with no confidentiality or integrity effect; the attack vector is network, complexity is low, no privileges or user interaction are required, because the h2 parser runs before any Authenticator check on the shared port. The real-world priority therefore hinges on exposure: a bRPC server directly serving h2/gRPC to untrusted networks faces a trivial, reliable crash and should patch promptly; the absence of KEV/EPSS data suggests no evidence of widespread automated exploitation yet, consistent with a researcher-reported bug rather than an actively abused one. Note the record-vs-content discrepancy - the input is labeled CVE-2026-82953 but the detailed advisory text cross-references CVE-2026-78048; verify the canonical identifier before tracking.

An attacker able to reach a bRPC server's HTTP/2 or gRPC port sends a single crafted HEADERS frame whose HPACK block inserts 121 minimal 33-byte dynamic-table entries, each too small to trigger byte-based eviction. The 121st insertion overflows the fixed 120-slot ring buffer and hits an internal CHECK assertion, aborting the entire server process. No authentication or user interaction is needed, and a detailed reproduction is documented in the advisory though no packaged exploit is published.