Resource exhaustion in Apache bRPC - CVE-2026-78058
Published: October 23, 2026
Vulnerability identifier: #VU157351
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-78058
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through unbounded memory growth or a process crash.
The vulnerability exists due to uncontrolled resource consumption and inconsistent receive-side limit enforcement in Apache bRPC's HTTP/2 stack when handling streams, decoded headers, control-frame responses, and HPACK dynamic-table updates. A remote attacker can send crafted frames that accumulate pending streams or headers, generate buffered control responses while withholding TCP reads, or desynchronize HPACK table state to exhaust memory or crash the process.
Affected software
Apache bRPC
How to mitigate CVE-2026-78058
Install security update from vendor's website.
Apache bRPC - update to 1.18.0