{"id":"CVE-2026-54425","kind":"vulnerability","aliases":["CVE-2026-54425"],"related":[],"title":"Apache bRPC: HTTP/2 header decoding recursion lets remote attackers crash servers","description":"Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached.\n\nRoot Cause:\nThe bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update. The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space.\n\nAffected Scenarios:\nUse bRPC with the built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3343 \n\nNote:\nThe fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing.","summary":"Apache bRPC's built-in HTTP/2 HPACK decoder recurses once per Dynamic Table Size Update entry without a depth limit. A crafted header block with many such entries exhausts the thread stack and takes the service down.","severity":"high","cvss":null,"epss":0.00257,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-brpc","c++","http2","package"],"not_affected_if":["no-http2","trusted-network-only"],"how_to_check":"- Check the bRPC version in use, for example with `grep -ri brpc` in the build files or `ldd` on the binary for the brpc library.\n- Confirm whether the service enables the built-in HTTP/2 implementation and accepts traffic from untrusted networks.","fix":"- Upgrade bRPC to `1.18.0` or later.\n- Alternatively apply the patch from https://github.com/apache/brpc/pull/3343.","status":"open","published_at":"2026-10-21T12:17:21+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:51+00:00","updated_at":"2026-10-25T05:02:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:02:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bRPC to `1.18.0` or later.\n- Alternatively apply the patch from https://github.com/apache/brpc/pull/3343.","reach":"internet","title":"Apache bRPC: HTTP/2 header decoding recursion lets remote attackers crash servers","impact":"low","summary":"Apache bRPC's built-in HTTP/2 HPACK decoder recurses once per Dynamic Table Size Update entry without a depth limit. A crafted header block with many such entries exhausts the thread stack and takes the service down.","category":"package","nicknames":[],"who_cares":["apache-brpc","c++","http2"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote crash of the server process via stack exhaustion, causing denial of service.","analyst_note":"","how_to_check":"- Check the bRPC version in use, for example with `grep -ri brpc` in the build files or `ldd` on the binary for the brpc library.\n- Confirm whether the service enables the built-in HTTP/2 implementation and accepts traffic from untrusted networks.","needs_analyst":false,"not_affected_if":["no-http2","trusted-network-only"],"who_is_affected":"Services built on Apache bRPC that use its built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network are exposed. Deployments that do not serve HTTP/2 or sit only on trusted internal networks can deprioritize this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":3650,"output_tokens":546,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-54425':14A,17A '/apache/brpc/pull/3343':198C '1':182C '1.18.0':72C,187C '2':192C 'accept':172C 'affect':160C 'allow':73C 'apach':1A,19B,24B,69C 'apache-brpc':18B 'appli':193C 'attack':9A,75C 'block':48B,87C 'bound':144C 'brpc':2A,20B,25B,70C,125C,163C,184C 'built':28B,167C 'built-in':27B,166C 'c':21B 'caus':77C,123C 'chang':202C 'consecut':90C 'consum':156C 'contain':88C 'could':107C,155C 'craft':46B,84C 'crash':10A 'cve':12A,15A 'decod':5A,32B,67C,99C,105C,127C,129C,141C,208C 'denial':78C 'depth':43B,147C 'dynam':36B,91C,136C,204C 'end':117C 'entri':40B,52B,95C,132C,154C 'excess':157C 'exhaust':53B,108C 'field':115C 'fix':181C,189C,201C 'github.com':197C 'github.com/apache/brpc/pull/3343':196C 'header':4A,47B,86C,114C 'hpack':31B,66C,104C,126C,203C 'http/2':3A,30B,65C,85C,169C,173C 'http2':22B 'implement':170C 'input':119C 'instead':213C 'invok':102C 'issu':191C 'iter':211C 'let':7A 'limit':44B 'long':150C 'mani':50B,89C 'network':178C 'next':131C 'note':199C 'packag':23B 'pars':212C,216C 'patch':195C 'per':35B 'process':134C 'reach':121C 'recurs':6A,33B,62C,101C,128C,146C,215C 'remot':8A,74C 'root':122C 'scenario':161C 'send':82C 'sequenc':151C 'server':11A 'servic':60B,80C 'size':38B,93C,138C,206C 'space':159C 'stack':56B,111C,158C 'tabl':37B,92C,137C,205C 'take':58B 'thread':55B,110C 'traffic':174C 'uncontrol':61C 'untrust':177C 'updat':39B,94C,97C,139C,153C,207C 'upgrad':183C 'use':162C,210C 'version':186C 'without':41B","nicknames":[],"mitigations":[],"who_affected":"Services built on Apache bRPC that use its built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network are exposed. Deployments that do not serve HTTP/2 or sit only on trusted internal networks can deprioritize this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54425","severity":null,"published_at":"2026-10-21T12:17:21+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-54425","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54425","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}