Apache bRPC EUVD-2026-107227

Requires a bRPC server (version < 1.18.0) serving HTTP/2 or gRPC over the h2 protocol and reachable from an untrusted network. The advisory states the h2/HPACK parser is enabled by default on every bRPC server port and executes before any Authenticator check, so exploitation needs no authentication, no user interaction, and no non-default configuration - it works against the default 4096-byte HPACK dynamic table. The only real limiting factor is exposure: the server must actually serve h2/gRPC on a network-reachable port; pure non-h2 (e.g. baidu_std-only) deployments or ports not exposed to untrusted clients are not affected by this specific trigger.

This is a remote, unauthenticated denial-of-service (process abort) in Apache bRPC's HPACK decoder, disclosed as part of an Apache advisory bundling 35 fixes for release 1.18.0. No CVSS vector, EPSS score, KEV listing, or POC is present in the supplied data, so quantitative exploitation signals are entirely absent and cannot be compared. On the qualitative evidence the risk is genuine but bounded: the description establishes a deterministic, low-complexity trigger - a peer sends 121 minimal 33-byte HPACK dynamic-table entries (121*33 = 3993 bytes, under the default 4096-byte table limit) so byte-driven eviction never fires, and the 121st AddHeader violates CHECK(!_header_queue.full()), aborting the process. Impact is availability-only (crash/DoS); there is no indication of confidentiality or integrity impact or code execution. Crucially the advisory states the h2/HPACK parser is enabled by default on every bRPC server port and runs before any Authenticator check, so no privileges or user interaction are needed. Net: a real, reliably reproducible DoS that should be prioritized by anyone exposing bRPC h2/gRPC to untrusted networks, but it is not a high-CVSS code-execution emergency - treat as a patch-soon availability bug, not an actively-exploited RCE. All exploitation-probability claims here are inferred from the description because EPSS/KEV/POC data were not provided.

An attacker reachable on a bRPC server's HTTP/2 or gRPC port opens an h2 connection and sends a single crafted HEADERS block containing 121 minimal (33-byte) HPACK dynamic-table entries. During HPACK decoding the dynamic-table ring buffer fills beyond its 120 allocated slots, the 121st AddHeader fails the CHECK(!_header_queue.full()) assertion, and the server process aborts - a clean unauthenticated remote crash. No public exploit identified at time of analysis, though the trigger is precisely documented in the advisory and trivially reproducible.