SB2026102312 - Multiple vulnerabilities in Apache bRPC

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102312

SB2026102312 - Multiple vulnerabilities in Apache bRPC

Published: October 23, 2026

Security Bulletin ID SB2026102312
CSH Severity
High
Patch available
YES
Number of vulnerabilities 35
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 6% Medium 94%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 35 vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2026-82953)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC RTMP server.

The vulnerability exists due to a null pointer dereference in Apache bRPC's RtmpChunkStream::OnCreateStream() error path when RtmpService::NewStream() returns null and writing the rejection response fails. A remote attacker can send a createStream command to a service that rejects it and close the connection before the rejection response is written to trigger access to stream->_onfail_id through a null pointer and crash the server.


2) Out-of-bounds read (CVE-ID: CVE-2026-79704)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to crash a bRPC client or potentially expose unintended memory contents during stream handling.

The vulnerability exists due to an out-of-bounds read in Apache bRPC's multi-stream RPC response handling when the returned extra_stream_ids list is shorter than the number of additional locally created streams. A remote attacker can return a malformed StreamSettings response from a malicious server, or modify the response from an on-path position, to trigger unchecked list indexing and potentially crash the client or leak memory into subsequent stream handling.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80463)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting server memory.

The vulnerability exists due to uncontrolled memory allocation in Apache bRPC's stream message reassembly path when continuation frames accumulate in _pending_buf without an aggregate size limit. A remote attacker can open a stream and send an endless sequence of continuation data frames to grow the receiver's buffered message until the process crashes or becomes unavailable.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-81755)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting server memory.

The vulnerability exists due to uncontrolled resource allocation in Apache bRPC's StreamAccept handling when creating a response stream for every identifier declared in a request without a per-request stream-count limit. A remote attacker can send a single RPC request containing an excessive number of stream_settings.extra_stream_ids to allocate large numbers of execution queues and associated resources and exhaust server memory.


5) Reachable assertion (CVE-ID: CVE-2026-82210)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating a bRPC server process.

The vulnerability exists due to reachable assertions in Apache bRPC's streaming feedback handling when a feedback frame contains an unexpected payload or reaches a stream with flow control disabled. A remote attacker can establish a stream and send a malformed FRAME_TYPE_FEEDBACK frame to trigger CHECK(_cur_buf_size > 0) or CHECK(buf.IsEmpty()) and abort the server process.


6) Uncontrolled Recursion (CVE-ID: CVE-2026-82230)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting a bRPC server's stack.

The vulnerability exists due to uncontrolled recursion in Apache bRPC's mcpack2pb parser when parsing nested objects and arrays without enforcing a depth limit. A remote attacker can send deeply nested mcpack data to a server using a recursive-schema protobuf message over nshead_mcpack, ubrpc, or public_pbrpc to drive unbounded recursive parsing and crash the process.


7) Uncaught Exception (CVE-ID: CVE-2026-82231)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating a bRPC Thrift client process.

The vulnerability exists due to uncaught exceptions in Apache bRPC's Thrift client response decoder when processing a malformed exception structure in a T_EXCEPTION reply. A remote attacker can return a crafted reply from a malicious server peer to make a decoding exception escape the bthread task function and invoke std::terminate(), terminating the whole process.


8) Reachable assertion (CVE-ID: CVE-2026-82425)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by aborting a bRPC client process.

The vulnerability exists due to a reachable assertion in Apache bRPC's Socket::OnInputEvent when a stale input event reaches a socket revived by health checking while its file descriptor remains closed. A remote attacker can deliberately abort connections and immediately accept health-check probes to race connection teardown against socket revival and trigger a process-terminating CHECK failure.


9) Race condition (CVE-ID: CVE-2026-82942)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC server process.

The vulnerability exists due to a race condition in Apache bRPC's RDMA transport when TCP and RDMA input paths access the same socket input buffer and parser state without synchronization after negotiation. A remote attacker can complete the RDMA handshake and send TCP data while RDMA messages are being processed to corrupt the shared input state and crash the server.

RDMA must be enabled at build time and runtime; deployments without RDMA are not affected.


10) Missing Authentication for Critical Function (CVE-ID: CVE-2026-78334)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass server authentication and inject unauthorized streaming RPC frames.

The vulnerability exists due to missing authentication and improper connection binding in Apache bRPC's streaming RPC parser when frames bypass InputMessenger's authentication hook and streams bind lazily to an incoming frame's socket. A remote attacker can send unauthenticated streaming frames or frames carrying another connection's stream identifier to make the server accept unauthorized stream data.


11) Use-after-free (CVE-ID: CVE-2026-84727)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to crash a bRPC process or potentially corrupt its memory.

The vulnerability exists due to use-after-free in Apache bRPC's RTMP chunk stream handling when an Abort message deletes an object concurrently accessed by the send path without synchronization. A remote attacker can send an Abort message targeting a chunk stream being used to serialize an outgoing message to free the object while sender threads still dereference it, potentially crashing the process or corrupting memory.


12) Interpretation Conflict (CVE-ID: CVE-2026-84747)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass front-proxy access controls and reach restricted bRPC resources.

The vulnerability exists due to inconsistent request-path interpretation in Apache bRPC's FindMethodPropertyByURI() when dispatching paths containing empty segments behind a proxy that applies access controls to literal paths. A remote attacker can send a path such as //flags?setvalue= that the proxy forwards but bRPC treats as the restricted /flags path to reach a resource the proxy intended to block.


13) Missing Authorization (CVE-ID: CVE-2026-84748)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to access internal-only builtin services and disclose sensitive runtime information through the public port.

The vulnerability exists due to missing authorization in Apache bRPC's protobuf-based protocol dispatch paths when the security_mode restriction associated with ServerOptions.internal_port is computed but not enforced before method invocation. A remote attacker can invoke builtin services by name over an enabled protobuf-based protocol on the public port to obtain metrics, flags, or profiler data intended for internal access only.


14) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-86146)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle HTTP requests, inject headers, or desynchronize HTTP responses.

The vulnerability exists due to inconsistent HTTP message interpretation in Apache bRPC's bundled HTTP/1.1 parser when its handling of malformed framing headers, chunked trailers, or Transfer-Encoding lists differs from an intermediary's parsing. A remote attacker can send ambiguous headers such as Content-Length : 5 or Content-Length: 1 3, or place Authorization or X-Forwarded-For fields in chunked trailers, to create framing discrepancies or introduce headers that the front-end did not inspect.


15) External Control of File Name or Path (CVE-ID: CVE-2026-86147)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create directories, truncate or overwrite files with the server process's privileges, or monopolize process-wide profiling resources.

The vulnerability exists due to external control of file paths and uncontrolled resource consumption in Apache bRPC's builtin /flags and /pprof services when accepting runtime dump-path changes or unbounded profiling durations. A remote attacker can change dump-path flags and enable dumping, use '..' in dump tab names, or request ?seconds=2147483647 to write to attacker-chosen file locations or hold the CPU or contention profiler for an arbitrarily long time.


16) Improper Authentication (CVE-ID: CVE-2026-86249)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and access ordinary protected services through the internal port.

The vulnerability exists due to improper authentication in Apache bRPC's VerifyHttpRequest() handling when both ServerOptions.auth and ServerOptions.internal_port are configured and a builtin-service exemption authenticates an entire connection. A remote attacker can first send GET /status to the internal port and then send requests for ordinary services over the same connection to access them without valid credentials.


17) Out-of-bounds read (CVE-ID: CVE-2026-87849)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by potentially crashing a bRPC client.

The vulnerability exists due to an out-of-bounds read in Apache bRPC's Discovery naming-service reply parser when RapidJSON object-only accessors are called on values without verifying that they are objects. A remote attacker can return a malformed /discovery/nodes or /discovery/fetchs response from a malicious Discovery backend containing non-object data, service, or instance entries to trigger undefined member-access behavior and potentially crash clients refreshing their server lists.


18) NULL pointer dereference (CVE-ID: CVE-2026-90484)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC MySQL client.

The vulnerability exists due to a null pointer dereference in Apache bRPC's MysqlReply::ConsumePartialIOBuf when a zero-payload-length response passes the frame-length check but a subsequent five-byte fetch returns nullptr. A remote attacker can send a zero-length response packet from a malicious MySQL server, or inject one from an on-path position, to trigger an unchecked access to the response type byte and crash the client process.


19) Out-of-bounds read (CVE-ID: CVE-2026-61916)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC process.

The vulnerability exists due to out-of-bounds reads in Apache bRPC's URL parsing and case-insensitive header lookup tables when high-bit input bytes are promoted to indices on platforms where plain char is unsigned. A remote attacker can send a request URI or applicable header names containing bytes from 0x80 to 0xFF to access memory beyond the biased lookup tables and crash the process.


20) Uncontrolled Recursion (CVE-ID: CVE-2026-54425)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting the thread stack.

The vulnerability exists due to uncontrolled recursion in Apache bRPC's HTTP/2 HPACK decoder when processing consecutive Dynamic Table Size Update entries. A remote attacker can send a crafted HTTP/2 header block containing many such entries to trigger unbounded recursive decoding and exhaust the thread stack.


21) Uncontrolled Recursion (CVE-ID: CVE-2026-54426)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC Redis client process.

The vulnerability exists due to uncontrolled recursion in Apache bRPC's Redis reply parser when processing nested RESP arrays without a depth limit. A remote attacker can return a deeply nested array reply from a malicious Redis server peer to exhaust the client process's stack and crash it.


22) Uncontrolled Recursion (CVE-ID: CVE-2026-54427)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC process.

The vulnerability exists due to uncontrolled recursion in Apache bRPC's AMF parser when processing nested objects or arrays without a depth limit. A remote attacker can send deeply nested AMF containers from an RTMP peer to exhaust the native stack and crash the receiving process.


23) Out-of-bounds read (CVE-ID: CVE-2026-56386)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer underflow and an out-of-bounds read in Apache bRPC's HTTP/2 server DATA frame parser when processing a zero-length payload with the PADDED flag set. A remote attacker can send a malformed DATA frame to underflow the unsigned fragment size and trigger a read of the pad length byte beyond the frame buffer, causing a denial of service.


24) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-56387)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive memory allocation and resource consumption.

The vulnerability exists due to uncontrolled resource allocation in Apache bRPC's RTMP AMF parser when accepting untrusted string lengths and array counts before validating the available input or enforcing allocation limits. A remote attacker can send a small AMF payload declaring an excessive long string length or array count to consume excessive resources before the incomplete payload is rejected.


25) Out-of-bounds write (CVE-ID: CVE-2026-56388)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC Redis server process.

The vulnerability exists due to an out-of-bounds write in Apache bRPC's RedisCommandParser::ConsumeImpl when an empty RESP command array is accepted and parsing continues into a subsequent bulk string. A remote attacker can send an empty array header followed by a bulk string to trigger a write to _args[0] in an empty argument vector and crash the process.


26) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-58064)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive memory use and CPU copying overhead.

The vulnerability exists due to uncontrolled resource allocation in Apache bRPC's Redis inline command parser when allocating and copying the entire connection buffer before locating a complete CRLF-terminated command. A remote attacker can send long inline inputs without a terminating CRLF to repeatedly increase allocation and copying costs and potentially make the service unavailable.


27) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-61902)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to inconsistent enforcement of resource limits in Apache bRPC's non-progressive HTTP/1 and HTTP/2 parsers and memcache and couchbase response parsers when buffering message bodies. A remote attacker can send message data exceeding the configured max_body_size limit to make an affected process buffer excessive data and potentially exhaust its memory.


28) Improper Authentication (CVE-ID: CVE-2026-48830)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication for protected HTTP endpoints.

The vulnerability exists due to improper authentication in Apache bRPC's HTTP connection handling when processing builtin requests on an HTTP/1.1 keep-alive connection. A remote attacker can send a builtin request as the first message on a connection, then send requests to protected non-builtin endpoints on that connection to access them without valid credentials.


29) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-66392)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate the TLS endpoint requested by a bRPC client.

The vulnerability exists due to improper certificate hostname validation in Apache bRPC's TLS client when peer verification validates a certificate chain without checking the expected DNS name or IP address. A remote attacker can redirect or intercept a connection and present a certificate for another identity issued by a CA trusted by the client to impersonate the intended endpoint.


30) Integer underflow (CVE-ID: CVE-2026-74755)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating a bRPC server process.

The vulnerability exists due to integer underflow in Apache bRPC's mcpack2pb UnparsedValue::as_string() function when subtracting one from an unvalidated string value_size of zero. A remote attacker can send a crafted mcpack request containing such a string field to make resize() throw an uncaught std::length_error and abort the process.


31) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-74757)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through excessive memory allocation.

The vulnerability exists due to uncontrolled resource allocation in Apache bRPC's mcpack2pb parser and generated protobuf parsing code when trusting an array item count without validating it against the payload size. A remote attacker can send a crafted mcpack request declaring item_count = 0x7fffffff to trigger approximately 16 GB of virtual-memory preallocation through Reserve(), potentially aborting the process on a memory-constrained host.


32) Use-after-free (CVE-ID: CVE-2026-74758)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC RTMP server.

The vulnerability exists due to use-after-free in Apache bRPC's RTMP Abort message handling when an Abort message deletes the chunk stream whose Feed() method is currently running. A remote attacker can send an Abort control message naming its own carrying chunk stream to make Feed() access the deleted object after the handler returns and crash the process.


33) Reachable assertion (CVE-ID: CVE-2026-78048)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by aborting a bRPC server process.

The vulnerability exists due to a reachable assertion in Apache bRPC's HPACK decoder when dynamic-table capacity is calculated using a 34-byte minimum entry size although valid entries can occupy 33 bytes. A remote attacker can send a crafted header sequence that inserts 121 minimal entries into the default 4096-byte table to exhaust its 120 allocated slots and trigger CHECK(!_header_queue.full()), aborting the process.


34) Resource exhaustion (CVE-ID: CVE-2026-78058)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through unbounded memory growth or a process crash.

The vulnerability exists due to uncontrolled resource consumption and inconsistent receive-side limit enforcement in Apache bRPC's HTTP/2 stack when handling streams, decoded headers, control-frame responses, and HPACK dynamic-table updates. A remote attacker can send crafted frames that accumulate pending streams or headers, generate buffered control responses while withholding TCP reads, or desynchronize HPACK table state to exhaust memory or crash the process.


35) Resource exhaustion (CVE-ID: CVE-2026-78066)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through disproportionate memory consumption or process termination.

The vulnerability exists due to uncontrolled resource consumption in Apache bRPC's decompression and protocol parsing paths when accepting unbounded decompressed output or unvalidated wire-declared sizes. A remote attacker can send highly compressed bodies or crafted AMF, RTMP, sofa-pbrpc, or mcpack2pb messages to trigger excessive allocations, growing reassembly buffers, or a size underflow that aborts the process.


Remediation

Install update from vendor's website.

References