Apache bRPC v<1.18.0 has an unbounded resource consumption flaw in the HTTP/2 receive path. The server parses HTTP/2 frames without enforcing advertised limits, allowing a malicious client to send crafted frames that grow the server’s memory unboundedly or trigger a crash. The vulnerability is an uncontrolled resource consumption (CWE-400) and a null pointer dereference (CWE-476). Remote unauthenticated attackers can abuse the flaw by sending large or specially crafted SETTINGS, HEADERS, or control frames, leading to denial of service or memory exhaustion.

The flaw affects all Apache bRPC deployments that use the HTTP/2 or gRPC interfaces and are running a version older than 1.18.0, on any operating system. Because the HTTP/2 parser is invoked before authentication checks, both servers and clients that connect to untrusted networks are vulnerable.

Remote and does not require local privileges or prior authentication. Attackers can exploit by sending crafted HTTP/2 frames over an open network connection. EPSS <1% indicates a very low probability of exploitation, and the vulnerability is not in the CISA KEV catalog. However, the lack of enforced limits provides a substantial attack surface for denial of service. The CVSS score of 7.5 indicates high severity given the potential for significant memory growth or crash. Nevertheless, the known exploit conditions combined with the low EPSS suggest the overall risk is notable but exploitation remains unlikely.