Apache bRPC CVE-2026-86146

The target must be a bRPC server (version < 1.18.0) serving HTTP/2 or gRPC over the h2 protocol and reachable from an untrusted network. This is the default configuration - the h2 parser is enabled on every bRPC server port and HPACK decoding occurs before any Authenticator check, so no credentials or user interaction are required. The only practical limits are network reachability to an h2/gRPC listener and the server running an affected version (<= 1.17.0); the default 4096-byte HPACK dynamic table is precisely the vulnerable condition, and impact is bounded to a single-process crash rather than code execution or data disclosure.

No CVSS vector was supplied in the input (CVSS: N/A), so the following is an independent assessment. This is a remote denial-of-service: the description states a peer can add 121 minimal 33-byte HPACK entries without triggering byte-based eviction, causing the 121st AddHeader to hit CHECK(!_header_queue.full()) and abort the process. Grounding in the description, the attack is network-reachable, low-complexity (just send a crafted header block), needs no user interaction, and the h2 parser is enabled by default and runs before any Authenticator check - yielding a self-assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, High). Impact is confined to availability (a clean CHECK abort/crash) with no confidentiality or integrity loss and no code execution, so this is a real priority for any deployment exposing h2/gRPC to untrusted networks but is a crash primitive, not a compromise. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation-likelihood signals are entirely absent; note the ease of triggering (trivial, pre-auth, default config) means a weaponized crash is plausible even though no exploitation evidence exists yet. CAVEAT: the provided description text bundles several distinct advisory entries (CVE-2026-78058, -78066, -78334) and its reference points to CVE-2026-78048 rather than CVE-2026-86146 - verify the precise affected-version range and identifier mapping against the upstream Apache advisory.

An attacker reachable to a bRPC server's default h2/gRPC port opens an HTTP/2 connection and sends a HEADERS block containing 121 minimal 33-byte HPACK entries (121*33 = 3993 bytes, under the 4096-byte table cap so no eviction occurs). The 121st AddHeader exceeds the ~120 available ring-buffer slots and trips CHECK(!_header_queue.full()), aborting the server process. No exploit code was identified in the provided data; only the fixing patch (apache/brpc PR #3462) is referenced.