Apache bRPC CVE-2026-90484

The target must be a bRPC server (version <= 1.17.0) that serves HTTP/2 or gRPC over the h2 protocol and is reachable from an untrusted network; per the advisory the h2 parser is enabled by default on every bRPC server port and processes the malicious header block during HPACK decoding BEFORE any Authenticator check, so no credentials are required. The specific prerequisite is that the attacker can open an h2/gRPC connection and submit a HEADERS block; the limiting factors are that the deployment must actually expose an h2/gRPC listener (not only legacy baidu-std/other protocols) and must run an unpatched version - upgrading to 1.18.0 or applying PR #3462 removes the condition. Impact is limited to process crash (availability); no confidentiality or integrity effect.

No CVSS vector, EPSS score, KEV listing, or POC reference is present in the supplied data, so quantitative exploitation signals are entirely MISSING and this assessment is derived from the advisory text alone. Based on that text, the real-world risk profile is a remote, pre-authentication denial-of-service: the h2/HPACK parser runs before any Authenticator check on a port enabled by default, and a peer can send 121 minimal 33-byte header entries (121*33 = 3993 <= 4096) to trip CHECK(!_header_queue.full()) and abort the entire server process. My independently assessed vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H, C:N, I:N), which maps to a High base score - consistent with the 'high' severity Apache assigned to the sibling h2 DoS CVEs in the same advisory batch. The practical priority is tempered by impact scope: this is a crash/availability bug, not code execution or data exposure. EPSS is unavailable so widespread automated exploitation cannot be confirmed or ruled out; given the trivial attack complexity (a few hundred bytes, no auth, deterministic abort) weaponization would be easy if an attacker targets exposed bRPC h2 endpoints, but there is no evidence of active exploitation.

An attacker who can reach a bRPC server's HTTP/2 or gRPC (h2) port sends a single crafted HEADERS block during a normal connection handshake, packing 121 minimal 33-byte HPACK dynamic-table entries that stay under the 4096-byte byte budget but exceed the 120 available ring-buffer slots. The 121st insertion hits an internal CHECK and aborts the process, denying service to all clients. No public exploit code is identified at time of analysis, though the trigger is simple and fully specified in the advisory.