Apache bRPC CVE-2026-84748

Requires a bRPC server at version 1.17.0 or earlier that serves HTTP/2 or gRPC via the h2 protocol and is reachable from an untrusted network. The h2/HPACK parser is enabled by default on every bRPC server port and processes the malicious header block during HPACK decoding before any Authenticator check, so no authentication, user interaction, or non-default configuration is required - the default 4096-byte dynamic table is the vulnerable condition. Limiting factors: the target must actually expose an h2/gRPC listener (plain-HTTP-only or non-h2 deployments are not affected via this path), and upgrading to 1.18.0 or applying PR #3462 fully removes the condition by sizing the table for the 33-byte minimum entry.

This is a remote, pre-authentication denial-of-service (process crash) affecting Apache bRPC versions through 1.17.0 when serving HTTP/2 or gRPC (h2) traffic. No CVSS vector, EPSS score, KEV listing, or public POC was provided in the input, so quantitative exploitation-probability signals are entirely absent and cannot be compared. The qualitative signals are consistent, however: the advisory states the h2/HPACK parser runs before any Authenticator check on the shared default port, so the attack surface is network-facing and requires no credentials, and the trigger is a deterministic CHECK() abort rather than a probabilistic memory-corruption condition, making reliable crashing trivial once an attacker can reach the port. Technical impact is confined to availability - the vulnerability aborts the process via a failed CHECK on a full dynamic-table ring buffer; there is no indication of confidentiality or integrity impact, code execution, or scope change. Net assessment: a genuine availability priority for internet-exposed bRPC h2/gRPC endpoints because it is low-complexity and unauthenticated, but it is NOT a critical RCE and real-world urgency is tempered by bRPC's limited deployment footprint and the absence of any confirmed exploitation. Note a data caveat: the supplied description text and the CVE cross-reference (CVE-2026-78048) appear bundled within a 35-vulnerability advisory, so the exact CVE-ID-to-finding mapping for CVE-2026-84748 should be verified against the Apache advisory before action.

An attacker reachable to a bRPC server's HTTP/2 or gRPC port sends a crafted HPACK header block containing 121 minimal 33-byte dynamic-table entries (121*33 = 3993 bytes, under the default 4096-byte table limit). Because eviction is driven by byte usage rather than slot count, the entries are never evicted, and the 121st AddHeader hits CHECK(!_header_queue.full()), aborting the server process. No authentication is needed and no public exploit code was identified at time of analysis, though the mechanism is simple enough to reproduce from the advisory.