Live › vulnerability › CVE-2026-54425
Go to dashboardApache bRPC's built-in HTTP/2 HPACK decoder recurses once per Dynamic Table Size Update entry without a depth limit. A crafted header block with many such entries exhausts the thread stack and takes the service down.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Services built on Apache bRPC that use its built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network are exposed. Deployments that do not serve HTTP/2 or sit only on trusted internal networks can deprioritize this.
No product ranges from the sources yet.
grep -ri brpc in the build files or ldd on the binary for the brpc library.1.18.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached.
Root Cause: The bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update. The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space.
Affected Scenarios: Use bRPC with the built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network.
How to Fix:
Note: The fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing.
This page as .md · .json · in your agent: get_signal("CVE-2026-54425")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.