EUVD-2026-107222
GHSA-qqp7-xh38-h7v3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach bRPC h2/gRPC port
-
DeliverySend crafted HPACK HEADERS block
-
ExploitAdd 121 minimal 33-byte entries
-
ExecutionOverflow dynamic-table slot count
-
PersistTrip CHECK assertion
-
ImpactServer process aborts (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a bRPC server (version ≤ 1.17.0) serving HTTP/2 or gRPC via the h2 protocol and reachable from an untrusted network. No special configuration or non-default mode is needed: the h2 parser is enabled by default on every bRPC server port and processes the malicious HPACK header block before any Authenticator check, so exploitation is remote and pre-authentication. The only real limiting factor is that the target port must actually accept h2/gRPC traffic; impact is confined to a process crash (availability loss), with no code execution or data access. |
| Impact | This is a remote, unauthenticated denial-of-service (process abort) in Apache bRPC's HTTP/2 HPACK decoder: because the dynamic table is sized assuming a larger minimum entry, a peer can add 121 minimal 33-byte header entries (121*33=3993 ≤ 4096 bytes) without triggering byte-based eviction, overflowing the fixed slot count and hitting CHECK(!_header_queue.full()), which aborts the process. No CVSS vector, EPSS score, KEV listing, or POC is provided in the input, so exploitation-probability and active-exploitation signals cannot be cross-referenced - assessment relies on the advisory description alone. The intrinsic risk is nonetheless meaningful: the h2 parser is enabled by default on every bRPC port and runs before any Authenticator check, so the attack is pre-auth and reliable, but impact is limited to availability (crash/DoS) with no confidentiality or integrity exposure, keeping this below the tier of an RCE or data-disclosure flaw. Note also a metadata discrepancy: the supplied CVE ID (CVE-2026-84727) does not match any of the inline CVE records in the pasted advisory (78048, 78058, 78066, 78334); the described HPACK 33-byte issue corresponds to the entry referencing CVE-2026-78048 and patch PR #3462 - verify the correct CVE-to-finding mapping with the Apache advisory. |
| Exploit ScenarioDerived | An attacker with network reach to a bRPC server exposed over HTTP/2 or gRPC (the default-enabled h2 protocol) sends a single crafted HEADERS block containing 121 minimal 33-byte HPACK entries during normal request processing, before any authentication occurs. The 121st AddHeader overflows the undersized dynamic-table ring buffer and trips a CHECK assertion, aborting and crashing the server process. No POC is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Apache bRPC 1.17.0 and earlier can be aborted by a remote attacker sending a crafted HTTP/2 HEADERS block: the HPACK dynamic table is sized assuming a larger minimum entry size, so 121 minimal 33-byte entries (3993 bytes, under the 4096-byte default) fit without triggering byte-based eviction, overflow the ring buffer's fixed slot count, and hit CHECK(!_header_queue.full()), terminating the process. The h2 parser is compiled in and enabled on every bRPC server port and decodes HPACK headers before any Authenticator check, so exploitation is pre-authentication and requires only that the port accept h2/gRPC traffic; affected deployments are bRPC at or below 1.17.0 on any platform. Impact is limited to availability (process crash, no code execution or data exposure); no public exploit code or confirmed active exploitation was identified at time of analysis. This is one of 35 defects fixed in the bRPC 1.18.0 release, which also addresses related HTTP/2 resource-consumption issues tracked as CVE-2026-78058 and CVE-2026-78066.
RemediationAI
Vendor-released patch: upgrade to Apache bRPC 1.18.0, which is the first release containing the corrected dynamic-table sizing (max_size / (32 + 1)) plus the guard that keeps at least one ring-buffer slot when max_size is smaller than the minimum entry, preventing the malloc(0) initialisation failure. If upgrading immediately is not possible, apply the upstream fix at https://github.com/apache/brpc/pull/3462, and plan to take the full 1.18.0 release since it also closes the companion HTTP/2 issues (CVE-2026-78058, CVE-2026-78066, CVE-2026-78334). Because the h2 parser runs before authentication and is not gated behind an opt-in flag, there is no clean configuration-only disable; the practical compensating controls are to restrict network reachability of bRPC h2/gRPC ports to known clients with firewall rules or security groups (trade-off: breaks legitimate external or multi-tenant access), or to front the service with a proxy such as Envoy or nginx that terminates HTTP/2 and enforces its own HPACK header-list and header-count limits before forwarding (trade-off: adds a hop, and any end-to-end HTTP/2 or gRPC semantics must be preserved by the proxy). Connection-rate and concurrency limits offer only partial protection, since a single authenticated-free connection can trigger the abort. Note that the 1.18.0 defaults change behaviour: max_concurrent_streams becomes 1024 per connection, max_header_list_size becomes 1 MiB decoded per stream, and h2 control-frame acks now respect -socket_max_unwritten_bytes; operators who need the old behaviour must explicitly set 4294967295 or -h2_ack_ignore_eovercrowded, which reintroduces exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
bRPC's HTTP/2 implementation maintains an HPACK dynamic table backed by a fixed-size ring buffer (_header_queue) with eviction driven by accounted byte usage (_max_size) rather than by slot count. HPACK requires each entry to carry 32 bytes of overhead plus the name and value, so the smallest possible entry is 33 bytes (1-byte name, empty value). The code sized the queue as max_size / (32 + 2) = 4096 / 34 = 120 slots, which under-allocates: the correct sizing is max_size / (32 + 1) = 124 slots. With a default 4096-byte table a peer can add 121 entries of 33 bytes (3993 bytes) that never trip the byte-based eviction threshold, so the 121st AddHeader call reaches the CHECK(!_header_queue.full()) assertion and aborts the whole server process. Because HPACK decoding happens in the h2 receive path before request dispatch and before any Authenticator is consulted, the attacker needs no credentials. The same advisory release addresses the neighbouring class of unbounded-resource defects in the h2 receive path (unlimited concurrent streams, unenforced SETTINGS_MAX_HEADER_LIST_SIZE enabling HPACK bombs, control-frame acks bypassing -socket_max_unwritten_bytes, and dynamic-table size updates validated against the 4096 default instead of the advertised SETTINGS_HEADER_TABLE_SIZE), which collectively indicate that receive-side limits were trusted from the peer rather than enforced locally. No CWE identifier was supplied in the available data, though the defect is a resource-accounting/slot-exhaustion flaw that terminates in an assertion failure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Pre-auth h2 parser reachable over the network with a simple deterministic crash gives AV:N/AC:L/PR:N/UI:N; impact is process abort only, so C:N/I:N/A:H.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Executive ViewAI
Apache bRPC, the RPC framework used across a range of internal and customer-facing services, can be reliably crashed by a single crafted HTTP/2 request sent to any port that accepts h2 or gRPC traffic - meaning anyone able to reach a bRPC listener can take that service offline. There is no code execution or data exposure, so the risk is concentrated in service availability: where bRPC is shared infrastructure, a small number of requests can cascade into broad outages, failed SLAs and customer-visible downtime. Leadership should care because remediation is a framework-wide version upgrade owned centrally rather than a per-application fix, and the attack surface is every bRPC listener already reachable from untrusted networks.
Apply vendor patch: upgrade to bRPC 1.18.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB