Apache bRPC EUVD-2026-107220

Requires a bRPC server (version <= 1.17.0) that serves HTTP/2 or gRPC via the h2 protocol on a port reachable from an untrusted network; the h2 parser is enabled by default on every server port and performs HPACK decoding of incoming request headers before any Authenticator check, so no credentials, user interaction, or non-default configuration are needed. The default 4096-byte HPACK dynamic table (yielding ~120 slots) is the vulnerable condition. Limiting factors: the server must actually expose the h2/gRPC protocol - bRPC services that do not serve h2/gRPC are not reachable through this specific vector - and impact is confined to crashing the single server process (availability), with no data exposure or code execution.

This is a remote, pre-authentication denial-of-service in Apache bRPC's HTTP/2 (h2) HPACK decoder: a peer can add 121 minimal 33-byte dynamic-table entries (121*33 = 3993 <= 4096) without triggering byte-usage-driven eviction, so the 121st AddHeader trips CHECK(!_header_queue.full()) and aborts the process. No CVSS vector, CWE, EPSS score, KEV listing, or public POC was supplied in the input, so quantitative exploitation-probability and active-exploitation signals are all ABSENT rather than low - their absence cannot be read as 'safe'. On the signals that ARE present, the advisory states the h2 parser is enabled by default on every server port and processes the malicious header block during HPACK decoding before any Authenticator check, implying trivial attack complexity and no privileges; my independent assessment is therefore AV:N/AC:L/PR:N/UI:N with availability-only impact (process crash), roughly a 7.5/High. Exploitation status: no public exploit identified at time of analysis. Net: for any bRPC deployment that exposes h2/gRPC to untrusted networks this is a genuine, easily-triggered crash worth prompt patching, but impact is confined to availability (no confidentiality/integrity/RCE) and real-world urgency is tempered by the product's limited deployment footprint and the lack of any exploitation or POC evidence.

An unauthenticated attacker opens an HTTP/2 connection to a bRPC server's h2/gRPC port and sends a crafted HEADERS block containing 121 minimal 33-byte HPACK dynamic-table entries, which stay under the 4096-byte eviction threshold but exceed the ~120 ring-buffer slots. The 121st AddHeader hits a CHECK assertion and aborts the server process, taking down the service. No public proof-of-concept exploit was identified at the time of analysis.