Apache bRPC EUVD-2026-107189

Requires a bRPC server older than 1.18.0 that serves HTTP/2 (the h2 protocol) or gRPC and is reachable from an untrusted network; the h2 HPACK decoder runs on the shared port before any Authenticator check, so no credentials, user interaction, or non-default configuration are needed - the 4096-byte default dynamic table is itself the vulnerable condition. Exploitation is limited only by whether the h2/gRPC listener is exposed to attacker traffic and by the server version (<=1.17.0); servers not speaking h2/gRPC or already on 1.18.0 are not affected.

No CVSS vector, EPSS score, KEV listing, or POC reference is present in the input, so this assessment relies entirely on the Apache oss-security advisory text. Based on that text the flaw is a remote, unauthenticated denial of service: a peer serving HTTP/2 (h2) or gRPC to a bRPC server (<1.18.0) can add 121 minimal 33-byte HPACK dynamic-table entries (121*33=3993 <= the 4096 byte cap) without triggering byte-driven eviction, so the 121st AddHeader hits CHECK(!_header_queue.full()) and aborts the process. My independently assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS 3.1 base ~7.5, High) - availability-only, no data exposure or code execution. This is a genuine priority for anyone exposing bRPC h2/gRPC ports to untrusted networks because the parser runs before any authentication and the condition is deterministic and trivial to trigger, but the impact ceiling is a crash (process abort / restart loop), not compromise. No EPSS/KEV data means widespread active exploitation cannot be confirmed; exploitation status is best treated as no public exploit identified at time of analysis. Note the advisory bundles 35 bRPC fixes and the lead item's embedded reference points at CVE-2026-78048 rather than this ID (CVE-2026-81755) - verify the exact ID-to-defect mapping with the Apache advisory.

An attacker who can reach a bRPC server's port serving HTTP/2 or gRPC sends a single crafted HEADERS block containing 121 minimal 33-byte HPACK entries. These fit under the 4096-byte table cap so byte-based eviction never fires, but the fixed 120-slot ring buffer fills and the 121st AddHeader trips a CHECK that aborts the process, crashing the server without any authentication. No public exploit code is referenced, but the trigger is deterministic and requires only a hand-crafted header block.