Description
Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached.

Root Cause:
The bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update. The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space.

Affected Scenarios:
Use bRPC with the built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network.

How to Fix:
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3343

Note:
The fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via stack exhaustion
Action: Patch
AI Analysis

Impact

Uncontrolled recursion in the HPACK decoder caused by consecutive Dynamic Table Size Update entries leads to exhaustion of the thread stack and a denial of service. The flaw is a CWE‑674 vulnerability falling under unchecked recursion.

Affected Systems

Apache bRPC from the Apache Software Foundation, version 1.18.0 and earlier, when used with its built‑in HTTP/2 implementation and exposed to traffic from an untrusted network.

Risk and Exploitability

The vulnerability is exploitable remotely by an attacker who can send a crafted HTTP/2 header block; the CVSS score of 7.5 indicates a high severity. The EPSS score of < 1% reflects a low estimated public exploitation probability. The flaw is not listed in the CISA KEV catalog. Because the recursion depth is unbounded, an attacker can trigger a denial of service without needing privileged access, making the risk significant.

Generated by OpenCVE AI on October 30, 2026 at 16:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache bRPC to 1.18.0 or later to apply the iterative parsing fix
  • If unable to upgrade, apply the patch detailed in the provided GitHub pull request
  • Configure bRPC or surrounding infrastructure to limit HTTP/2 traffic from untrusted networks

Generated by OpenCVE AI on October 30, 2026 at 16:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache brpc
Vendors & Products Apache
Apache brpc

Wed, 21 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached. Root Cause: The bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update. The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space. Affected Scenarios: Use bRPC with the built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3343 Note: The fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing.
Title Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
Weaknesses CWE-674
References

Subscriptions

Apache Brpc
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-30T13:45:53.356Z

Reserved: 2026-06-14T06:18:42.168Z

Link: CVE-2026-54425

cve-icon Vulnrichment

Updated: 2026-10-30T13:45:37.165Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T12:17:21.053

Modified: 2026-10-30T14:17:05.960

Link: CVE-2026-54425

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T16:15:14Z

Weaknesses