CVE-2026-78058

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description Uncontrolled resource consumption in the HTTP/2 (h2) receive path allows a remote unauthenticated attacker to crash the server or cause unbounded memory growth by sending crafted HTTP/2 frames. The h2 parser, enabled by default on every server port and used by h2/gRPC clients, fails to enforce receive-side limits. Specifically, the server does not check SETTINGS MAX CONCURRENT STREAMS, allowing an unbounded number of pending streams per connection. Additionally, SETTINGS MAX HEADER LIST SIZE is not enforced, enabling an HPACK bomb where small HEADERS frames are amplified into massive decoded header lists, or memory accumulates via incomplete HEADERS/CONTINUATION blocks. Control-frame acknowledgments (including PING, SETTINGS, RST STREAM, GOAWAY, and WINDOW UPDATE) bypass the -socket max unwritten bytes write cap, allowing connection buffers to grow during a PING flood. Finally, the HPACK dynamic table size update is validated against a protocol default instead of the advertised SETTINGS HEADER TABLE SIZE, which can lead to decoder desynchronization and a NULL pointer dereference crash.

Recommendations Upgrade Apache bRPC to version 1.18.0 or later. Apply the official patch for the h2 parser to enforce resource limits.