The vulnerability is an off‑by‑bias out‑of‑bounds read in URL parsing and case‑insensitive header lookup tables. On platforms where plain char is unsigned, such as ARM64, input bytes with the high bit set are promoted to integers in the range 0x80–0xFF, causing the lookup tables to be indexed beyond their 0–255 bounds. The resulting memory read can read up to 127 bytes past the end of the table, allowing a remote attacker to trigger a process crash and deny service to legitimate users. The weakness corresponds to CWE‑125 and provides only denial of service; there is no remote code execution.

Affected systems are Apache bRPC deployments on any platform where plain char is unsigned, specifically all builds prior to version 1.18.0. The vulnerable code exists in URL parsing logic and the case‑insensitive header lookup used by HTTP/2 HPACK processing. Platforms that default to signed char, such as most x86_64 builds, are not impacted. All other versions of Apache bRPC released after 1.18.0 contain the fix that normalizes lookup‑table indices to the signed‑char range.

The attack vector is remote and unauthenticated over HTTP. A crafted request URI or header containing a high‑bit byte can exercise the vulnerable lookup and cause a crash. The EPSS score is below 1%, and the issue is not listed in CISA KEV, indicating no widespread exploitation yet. The CVSS score of 7.5 indicates a high severity. Nevertheless, any exposed bRPC HTTP server can be brought down with a simple request. The weakness corresponds to CWE‑125 and provides only denial of service; there is no remote code execution.