Apache bRPC EUVD-2026-107229

Requires a bRPC server (version < 1.18.0) serving HTTP/2 or gRPC via the h2 protocol on a port reachable from an untrusted network - per the advisory the h2 parser is enabled by default on every bRPC server port and runs before any Authenticator, so no special configuration is needed to expose it. The concrete trigger is a single HPACK header block carrying 121 minimal 33-byte dynamic-table entries, which overflows the fixed ring buffer sized for the 4096-byte default table. Limiting factors: the server must actually accept h2/gRPC traffic from the attacker's network position, and the impact is a process crash (availability) only - there is no code execution or data exposure. No authentication, user interaction, or non-default setting is required.

No CVSS, EPSS, KEV, or POC signals were provided in the input, so risk must be inferred from the Apache advisory text alone. The flaw is a remotely-triggerable denial of service: during HPACK decoding of incoming HTTP/2/gRPC requests, a peer can insert 121 minimal 33-byte dynamic-table entries (121*33 = 3993 <= 4096) without triggering byte-driven eviction, overflowing the fixed ~120-slot ring buffer and hitting CHECK(!_header_queue.full()), which aborts the process. The advisory states this is processed 'without authentication' and the h2 parser runs before any Authenticator on the default-enabled port, so on exposure this is trivially reachable (my independent assessment is AV:N/AC:L/PR:N, ~7.5 High, availability-only). This is a real priority for any bRPC server with h2/gRPC exposed to untrusted networks because exploitation is cheap and the patch (PR 3462) is public, lowering the bar to weaponization - but impact is confined to availability (crash), with no confidentiality or integrity loss and no RCE. There are NO active-exploitation signals: EPSS, KEV, and POC are all absent from the input, so this is currently a theoretical-but-easy DoS rather than a confirmed in-the-wild threat. Note a data discrepancy: the record is labeled CVE-2026-87849 yet its own references point to CVE-2026-78048 - verify the correct identifier with the Apache advisory.

An attacker who can reach a bRPC server's default h2/gRPC port sends a single crafted HEADERS block containing 121 minimal (name>=1 byte, empty value) HPACK indexed entries. Because eviction is driven by byte usage rather than slot count, the entries fit under the 4096-byte table limit but exhaust the ~120-slot ring buffer, and the 121st insertion trips a CHECK assertion that aborts the server process. No authentication is required and no public POC is identified at time of analysis, though the fix commit in PR 3462 reveals the exact trigger.