Apache bRPC EUVD-2026-107228

Requires a bRPC server (version < 1.18.0) exposing the HTTP/2 (h2) or gRPC protocol on a port reachable from an untrusted network, which is the default parser on bRPC server ports. The malicious header block is processed during HPACK decoding before any authenticator runs, so no credentials or user interaction are required. Exploitation is bounded only by network reachability to the h2/gRPC port and by the server running an affected version; the default 4096-byte HPACK table is sufficient to trigger the crash, so no non-default configuration is needed. Deployments that do not serve h2/gRPC, or that have upgraded to 1.18.0 / applied PR #3462, are not exploitable.

No CVSS vector, EPSS score, KEV listing, or POC indicator was supplied in the input, so quantitative exploitation signals are entirely absent and cannot be cross-referenced - this assessment rests on the Apache advisory text alone. The vulnerability is a remote denial-of-service: a crafted HPACK header block sent to a bRPC server's HTTP/2 (h2)/gRPC port causes a dynamic-table slot miscalculation (33-byte minimum entry sized as 4096/34 = 120 slots while eviction is driven by byte usage, not slot count), so the 121st minimal entry trips CHECK(!_header_queue.full()) and aborts the process. The advisory states the h2 parser runs before any Authenticator check on the shared port, implying pre-authentication reach, but because no CVSS vector was provided I cannot confirm PR:N from authoritative metrics - authentication requirements are asserted by the advisory, not by a scored vector. Impact is limited to availability (process crash); there is no indication of confidentiality or integrity loss. On balance this is a genuine, low-complexity remote-crash DoS worth prioritizing for any internet- or untrusted-network-exposed bRPC deployment, but it is NOT a high-real-risk code-execution issue, and the absence of EPSS/KEV/POC data means real-world exploitation prevalence is currently unknown rather than demonstrated.

An attacker able to reach a bRPC server's HTTP/2 or gRPC port sends a single crafted HEADERS frame containing 121 minimal 33-byte HPACK entries (121*33 = 3993 bytes, under the 4096-byte table cap), which never triggers byte-based eviction. The 121st AddHeader call exceeds the 120 allocated ring-buffer slots, hits an internal CHECK assertion, and aborts the server process, dropping all connections. No authenticated session is needed because HPACK decoding occurs before any authenticator check; no public exploit code was identified in the provided data.