EUVD-2026-107183
GHSA-gjf5-p37j-frg4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach bRPC HTTP/2 or gRPC port
-
ExploitSend 121 minimal 33-byte HPACK entries
-
ExecutionExceed ring-buffer slots without eviction
-
ImpactTrigger CHECK abort and crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Requires a bRPC server (version through 1.17.0) serving HTTP/2 or gRPC over the h2 protocol with its h2 port reachable from an untrusted network; the advisory states HPACK decoding occurs before any Authenticator check, so no credentials are needed. The trigger is a header block carrying 121 minimal (33-byte) HPACK entries against the default 4096-byte dynamic table. Exploitation is limited to deployments that actually expose an HTTP/2- or gRPC-enabled bRPC port to untrusted clients; servers not serving h2/gRPC or not reachable by attackers are not affected, and upgrading to 1.18.0 (which sizes the table as max_size/(32+1) and guarantees at least one slot) removes the condition. Impact is confined to process crash (denial of service); no data disclosure or modification occurs. |
| Impact | No CVSS score or vector is provided in the input (CVSS: N/A, CWE: N/A), and there is no EPSS score, no CISA KEV listing, and no indication of public exploit code - so no public exploit identified at time of analysis. Scoring must therefore be inferred from the vendor advisory. The flaw is a reachable CHECK() abort during HPACK decoding: the HPACK dynamic table is sized so only 120 slots exist for a 4096-byte table, while eviction is driven by byte usage rather than slot count, letting a peer add 121 minimal 33-byte entries (121*33 = 3993 <= 4096) without eviction and hit CHECK(!_header_queue.full()), aborting the process. This is an availability-only (denial-of-service) issue with no confidentiality or integrity impact. The advisory states the malicious header block is processed before any authentication and the h2 parser is enabled by default, which (if accurate) implies a low-complexity, unauthenticated, network-reachable crash - a genuine availability concern for internet-exposed bRPC HTTP/2/gRPC endpoints. However, absent an official CVSS vector, KEV, EPSS, or POC, the real-world exploitation likelihood is unquantified; the practical priority is driven by exposure (is the h2 port reachable from untrusted networks) rather than by any confirmed exploitation signal. Note: this record also bundles descriptions of several sibling CVEs (CVE-2026-78058, -78066, -78334) from the same advisory; this analysis addresses CVE-2026-78048 specifically. |
| Exploit ScenarioDerived | An attacker who can reach a bRPC server's HTTP/2 or gRPC (h2) port from an untrusted network sends a single crafted HEADERS block containing 121 minimal 33-byte HPACK entries. Because eviction is byte-based while the table has only ~120 slots, the entries fit under the 4096-byte cap without eviction, and the 121st AddHeader trips a CHECK assertion that aborts the server process. No authentication is required and no public exploit code is known, but the attack requires only a well-formed malicious header block and minimal complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in Apache bRPC through 1.17.0 lets a remote attacker abort the server process by sending a single crafted HTTP/2 header block that overruns the HPACK decoder's dynamic-table slot accounting. Because the h2 parser runs on the shared listening port before any Authenticator check, no credentials are needed whenever an h2/gRPC-enabled port is reachable from an untrusted network; 121 minimal 33-byte entries fit inside the 4096-byte byte budget but exceed the 120 available ring-buffer slots, tripping CHECK(!_header_queue.full()) and terminating the process. Impact is availability-only (no disclosure or modification), the condition is removed in bRPC 1.18.0, and no public exploit identified at time of analysis.
RemediationAI
Upgrade Apache bRPC to 1.18.0, the release that resolves this issue, or, if a version pin prevents an immediate upgrade, apply the upstream fix at https://github.com/apache/brpc/pull/3462, which re-sizes the dynamic table as max_size/(32+1) and preserves at least one ring-buffer slot when max_size is smaller than the minimum entry so that initialization cannot fail on malloc(0). Where neither is immediately possible, reduce exposure by removing h2/gRPC from untrusted-facing listeners - bind h2 ports to internal interfaces or restrict them with firewall/security-group rules to known client ranges, accepting that this is containment only, since the h2 parser executes before any Authenticator check and any client that reaches the port can trigger the abort. Placing an HTTP/2-aware proxy in front of bRPC that caps SETTINGS_MAX_HEADER_LIST_SIZE and rejects or truncates oversized header lists (a few KiB is sufficient to block 121-entry blocks) also works, at the cost of breaking legitimate clients that send large headers, and such a proxy must itself enforce limits rather than merely forward frames. Note that 1.18.0 additionally turns on new defaults from the companion fixes - max_concurrent_streams at 1024 per connection and max_header_list_size at 1 MiB decoded per stream - which should be reviewed and tuned with the corresponding flags before rollout to avoid rejecting legitimate traffic. Reference advisory: https://seclists.org/oss-sec/2026/q4/274.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the HPACK header-decompression path used when bRPC speaks HTTP/2 or gRPC over the h2 protocol. HPACK maintains a dynamic table with a byte-size cap (default 4096) and, in this implementation, backs the recently decoded entries with a fixed-size ring-buffer queue whose slot count is derived from the table size divided by the minimum possible entry footprint - 32 bytes of per-entry overhead plus at least 1 name byte and possibly zero value bytes, i.e. 33 bytes - yielding 120 slots for the default table. Eviction, however, is driven by consumed bytes (_max_size) rather than by the number of occupied slots, so a peer that transmits 121 entries of exactly 33 bytes consumes 3993 bytes (under the 4096-byte budget, hence no eviction) while needing one slot more than the queue can hold; the 121st AddHeader hits a CHECK assertion on a full queue and aborts the whole process. No CWE identifier is present in the supplied record, but the root cause aligns with a reachable assertion/abort (CWE-617) arising from inconsistent resource accounting. The corrected implementation sizes the table as max_size/(32+1) and guarantees at least one surviving ring-buffer slot when max_size is below the minimum entry size, so initialization cannot fail on malloc(0). Parsing happens on the shared port ahead of authentication, so the assertion is reachable pre-auth by any client that can open an h2 connection.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Advisory describes a default-enabled h2 parser reachable over the network and decoded before authentication (AV:N/AC:L/PR:N/UI:N); only availability is affected via a process-aborting CHECK (A:H, C:N/I:N).
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
2Description PRE-NVD
Executive ViewAI
A single crafted HTTP/2 request can terminate the Apache bRPC process (versions through 1.17.0), taking down the RPC transport that internal applications, gateways, and data pipelines rely on for service-to-service communication. The defect sits in the HTTP/2 header parser on the shared listening port and is reached before any access-control check, so any gRPC or HTTP/2 endpoint exposed to an untrusted network is a viable outage vector requiring only one small packet. Leadership should care because the risk is loss of availability across dependent production services, and the fix is an infrastructure version upgrade rather than a configuration toggle.
No vendor-released patch identified at time of analysis; the upstream project indicates the condition is removed in bRPC 1.18.0, which should be treated as the permanent remediation. Until that upgrade is complete: restrict all HTTP/2 and gRPC listeners on bRPC 1.17.0 and earlier to trusted internal network segments via firewall and security-group rules; disable HTTP/2 on any listener that must remain internet-facing or place it behind an ingress proxy/gateway that validates and normalizes HPACK header blocks and caps header-block size and entry count; enforce connection, stream, and request rate limits at the edge to raise the cost of repeated attempts; run bRPC processes under a supervisor with automatic restart and health checks to limit outage duration; segment RPC traffic so a crashed broker does not cascade to dependent services; and monitor for unexpected process exits and repeated connection churn on h2 ports as an early indicator of attempted triggering.
Threat Intelligence Overview
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB