Apache bRPC EUVD-2026-107223

The target must be a bRPC server (version <= 1.17.0) that accepts HTTP/2 or gRPC over the h2 protocol from an untrusted network - a default-enabled configuration, since the h2 parser runs on every bRPC server port before any Authenticator check. The specific trigger is HPACK decoding of an incoming request whose dynamic-table header block contains 121 minimal (33-byte: >=1-byte name + 0-byte value + 32 bytes overhead) entries, which stays within the 4096-byte _max_size eviction cap yet exceeds the 120 allocated ring-buffer slots. Limiting factors: exploitation requires the server to actually serve h2/gRPC (not plain HTTP/1 or other bRPC protocols), and impact is confined to crashing the process (availability only) - there is no authentication step to bypass per the advisory, but note the CVSS vector was not provided to independently confirm the privilege level.

Risk must be judged almost entirely from a single source - the Apache/oss-security vendor advisory - because no CVSS vector, CVSS score, CWE, EPSS probability, KEV entry, or POC indicator was supplied in the input; all of those signals are MISSING, so any claim of exploitation likelihood is inference, not data. On the signals that ARE present, the advisory is self-consistent and points to a genuine, easy-to-reach issue: the HPACK decoder on bRPC's HTTP/2 (h2)/gRPC receive path mis-sizes the dynamic table (120 slots for a 4096-byte table), and a peer can submit 121 minimal 33-byte header entries that satisfy the byte-based eviction limit (121*33 = 3993 <= 4096) but overflow the ring-buffer slot count, hitting CHECK(!_header_queue.full()) and aborting the process. The h2 parser is enabled by default and runs before any authentication check, so the trigger is reachable by an unauthenticated remote peer, which argues for treating this as a real availability priority for any bRPC server exposed to untrusted h2/gRPC traffic. The tempering factor is that impact is limited to a deterministic process crash (denial of service) with no confidentiality or integrity consequence and no code execution, and because EPSS/KEV/POC are all absent there is no evidence of active exploitation - this is a low-signal, patch-promptly item rather than a confirmed in-the-wild threat. One data conflict to flag: the input is titled CVE-2026-84747 but its reference block cites CVE-2026-78048, and the advisory bundles several adjacent CVEs (78058/78066/78334) - verify the exact record-to-ID mapping with the vendor before acting.

An attacker who can reach a bRPC server's default h2/gRPC port sends a single crafted HTTP/2 HEADERS frame whose HPACK block adds 121 minimal 33-byte dynamic-table entries, staying under the 4096-byte eviction cap while exceeding the 120 ring-buffer slots. The 121st AddHeader fails the CHECK(!_header_queue.full()) assertion and aborts the server process, producing an unauthenticated remote denial of service. No public exploit code was identified in the provided data, but the advisory describes the exact byte/slot math needed to reproduce it.