Apache bRPC EUVD-2026-107218

The target must be a bRPC server (version < 1.18.0) serving HTTP/2 (h2) or gRPC on a port reachable from an untrusted network; the h2 parser is enabled by default on every bRPC server port and processes the malicious header block during HPACK decoding before any authentication, so no non-default configuration, credentials, or user interaction are required. The specific trigger is the default 4096-byte HPACK dynamic table, which allocates only ~120 ring-buffer slots while eviction is byte-driven, allowing 121 minimal entries to overflow the queue. The principal limiting factor is that the server must actually expose and speak h2/gRPC on a network-reachable port; the flaw is availability-only (process abort) with no code execution or data exposure.

No CVSS vector, EPSS score, KEV listing, or POC reference is supplied in the input, so the quantitative exploitation signals are entirely absent and risk must be inferred from the technical description. On that basis this is a genuine, straightforwardly triggerable denial-of-service: the HPACK dynamic-table slot accounting bug lets a remote, unauthenticated peer abort the bRPC process by sending 121 minimal 33-byte header entries (121*33 = 3993 <= the default 4096-byte table), hitting CHECK(!_header_queue.full()). The h2 parser is enabled by default on every bRPC server port and runs before any Authenticator check, so there are no privilege or interaction barriers - my assessed vector is AV:N/AC:L/PR:N/UI:N/A:H (7.5 High). Impact is confined to availability (process crash/abort); there is no indication of confidentiality or integrity loss or code execution. Because no EPSS or KEV data exists, widespread active exploitation cannot be asserted - exploitation status is 'no public exploit identified at time of analysis' - but the low attack complexity and absence of authentication make this a real patching priority for any internet- or untrusted-network-facing bRPC h2/gRPC endpoint rather than a high-CVSS-but-low-real-risk theoretical issue.

An attacker able to reach a bRPC server's h2/gRPC port over an untrusted network sends a single crafted HEADERS block containing 121 minimal (name + empty value) HPACK entries during normal request processing. Because eviction is driven by byte usage rather than slot count, the undersized ring buffer fills and the 121st AddHeader trips a CHECK assertion, aborting the entire server process. No authentication or user interaction is required, though no public exploit code is identified at time of analysis.