PT-2026-120542 · Apache · Apache Brpc
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames.
Root Cause:
The h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clients, trusts the peer to respect receive-side limits that bRPC advertises but never enforces:
- SETTINGS MAX CONCURRENT STREAMS defaulted to unlimited and was never checked on the server, letting a peer pin an unbounded number of pending streams per connection (~100x memory amplification).
- SETTINGS MAX HEADER LIST SIZE defaulted to unlimited and was never enforced; 1-byte HPACK indexed references amplify a small HEADERS frame ~4000x into an unbounded decoded header list ("HPACK bomb"), and a never-completed HEADERS/CONTINUATION block accumulates memory without limit.
- Control-frame acks (PING/SETTINGS acks, RST STREAM, GOAWAY, WINDOW UPDATE) unconditionally bypassed the -socket max unwritten bytes write cap, so a PING flood combined with withheld TCP reads grew the connection buffer without the documented bound.
- The HPACK dynamic table size update was validated against the protocol default (4096) instead of the advertised SETTINGS HEADER TABLE SIZE, which together with the dynamic-table queue/accounting issue can desynchronize the decoder and dereference NULL (crash).
Affected scenarios:
Any bRPC server serving HTTP/h2/gRPC to an untrusted network, and any bRPC h2/gRPC client connecting to an untrusted backend. The h2 parser runs before any Authenticator check on the shared port.
How to fix:
Upgrade bRPC, or apply the patch in https://github.com/apache/brpc/pull/3474.
Note:
After applying the fix the following limits are enforced by default:
- max concurrent streams: 1024 per connection (4294967295 restores unlimited).
- max header list size: 1 MiB decoded size per stream (4294967295 restores unlimited; -h2 client max header list size for clients).
- h2 control-frame acks respect -socket max unwritten bytes (-h2 ack ignore eovercrowded restores the old behavior). Requests exceeding these limits are rejected (RST STREAM(REFUSED STREAM) or a connection error).
Resource Exhaustion
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Brpc