{"id":"CVE-2026-78058","kind":"vulnerability","aliases":["CVE-2026-78058"],"related":[],"title":"Apache bRPC: unauthenticated HTTP/2 frames can crash server or exhaust memory","description":"Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames.\n\nRoot Cause:\nThe h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clients, trusts the peer to respect receive-side limits that bRPC advertises but never enforces:\n1. SETTINGS_MAX_CONCURRENT_STREAMS defaulted to unlimited and was never checked on the server, letting a peer pin an unbounded number of pending streams per connection (~100x memory amplification).\n2. SETTINGS_MAX_HEADER_LIST_SIZE defaulted to unlimited and was never enforced; 1-byte HPACK indexed references amplify a small HEADERS frame ~4000x into an unbounded decoded header list (\"HPACK bomb\"), and a never-completed HEADERS/CONTINUATION block accumulates memory without limit.\n3. Control-frame acks (PING/SETTINGS acks, RST_STREAM, GOAWAY, WINDOW_UPDATE) unconditionally bypassed the -socket_max_unwritten_bytes write cap, so a PING flood combined with withheld TCP reads grew the connection buffer without the documented bound.\n4. The HPACK dynamic table size update was validated against the protocol default (4096) instead of the advertised SETTINGS_HEADER_TABLE_SIZE, which together with the dynamic-table queue/accounting issue can desynchronize the decoder and dereference NULL (crash).\n\nAffected scenarios:\nAny bRPC server serving HTTP/h2/gRPC to an untrusted network, and any bRPC h2/gRPC client connecting to an untrusted backend. The h2 parser runs before any Authenticator check on the shared port.\n\nHow to fix: \nUpgrade bRPC, or apply the patch in https://github.com/apache/brpc/pull/3474.\n\nNote:\nAfter applying the fix the following limits are enforced by default:\n- max_concurrent_streams: 1024 per connection (4294967295 restores unlimited).\n- max_header_list_size: 1 MiB decoded size per stream (4294967295 restores unlimited; -h2_client_max_header_list_size for clients).\n- h2 control-frame acks respect -socket_max_unwritten_bytes (-h2_ack_ignore_eovercrowded restores the old behavior).\nRequests exceeding these limits are rejected (RST_STREAM(REFUSED_STREAM) or a connection error).","summary":"Apache bRPC versions before 1.18.0 enforce no limits on concurrent HTTP/2 streams, header list size, or control-frame write buffering, and contain an HPACK table desync that can dereference NULL. A remote unauthenticated attacker can crash a bRPC server or grow its memory without bound by sending crafted HTTP/2 frames.","severity":"high","cvss":null,"epss":0.00307,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-brpc","c++","grpc","http2","package","self-hosted"],"not_affected_if":["internal-network-only","no-h2-or-grpc-traffic","version-1.18.0-or-later"],"how_to_check":"- Check the bRPC version the service is built against, for example with `grep -r brpc` in the build manifest or the lockfile; affected if below `1.18.0`\n- Check whether the server listens on a port that accepts HTTP/2 or gRPC traffic from untrusted networks, since the h2 parser is enabled by default on every bRPC server port\n- Check whether a bRPC h2/gRPC client connects to untrusted backends","fix":"- Upgrade Apache bRPC to `1.18.0` or later\n- Or apply the patch from https://github.com/apache/brpc/pull/3474\n- Keep the default limits: `max_concurrent_streams` 1024, `max_header_list_size` 1 MiB, and h2 control-frame acks respecting `-socket_max_unwritten_bytes`; only set `4294967295` to restore unlimited behavior if needed","status":"open","published_at":"2026-10-21T12:17:23+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:40+00:00","updated_at":"2026-10-25T05:02:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:02:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0` or later\n- Or apply the patch from https://github.com/apache/brpc/pull/3474\n- Keep the default limits: `max_concurrent_streams` 1024, `max_header_list_size` 1 MiB, and h2 control-frame acks respecting `-socket_max_unwritten_bytes`; only set `4294967295` to restore unlimited behavior if needed","reach":"internet","title":"Apache bRPC: unauthenticated HTTP/2 frames can crash server or exhaust memory","impact":"high","summary":"Apache bRPC versions before 1.18.0 enforce no limits on concurrent HTTP/2 streams, header list size, or control-frame write buffering, and contain an HPACK table desync that can dereference NULL. A remote unauthenticated attacker can crash a bRPC server or grow its memory without bound by sending crafted HTTP/2 frames.","category":"package","nicknames":[],"who_cares":["apache-brpc","grpc","http2","c++","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker crashes the server or exhausts its memory without credentials","analyst_note":"Confirm the exact affected version range and whether a patched release beyond 1.18.0 exists at https://nvd.nist.gov/vuln/detail/CVE-2026-78058; the sources only give the PR link and no CVSS score.","how_to_check":"- Check the bRPC version the service is built against, for example with `grep -r brpc` in the build manifest or the lockfile; affected if below `1.18.0`\n- Check whether the server listens on a port that accepts HTTP/2 or gRPC traffic from untrusted networks, since the h2 parser is enabled by default on every bRPC server port\n- Check whether a bRPC h2/gRPC client connects to untrusted backends","needs_analyst":true,"not_affected_if":["version-1.18.0-or-later","no-h2-or-grpc-traffic","internal-network-only"],"who_is_affected":"Any bRPC server that serves HTTP, HTTP/2 or gRPC on a port reachable from an untrusted network is exposed, because the h2 parser runs before any Authenticator check on the shared port. bRPC h2/gRPC clients connecting to untrusted backends are also affected. Services only reachable on a trusted internal network with no h2 traffic from outside are lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000855,"input_tokens":4168,"output_tokens":877,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-78058':14A,17A '/apache/brpc/pull/3474.':344C '1':149C,192C,370C '1.18.0':32B,92C '100x':176C '1024':360C '2':179C '3':222C '4':260C '4000x':202C '4096':273C '4294967295':363C,376C 'accumul':218C 'ack':226C,228C,391C,398C 'advertis':145C,277C 'affect':299C 'allow':96C 'amplif':178C 'amplifi':197C 'apach':1A,19B,28B,89C 'apache-brpc':18B 'appli':338C,347C 'attack':62B,100C 'authent':326C 'backend':319C 'behavior':404C 'block':217C 'bomb':210C 'bound':73B,110C,259C 'brpc':2A,20B,29B,66B,90C,126C,144C,302C,312C,336C 'buffer':48B,255C 'bypass':235C 'byte':193C,240C,396C 'c':21B 'cap':242C 'caus':117C 'check':160C,327C 'client':133C,314C,380C,386C 'combin':247C 'complet':215C 'concurr':37B,152C,358C 'connect':175C,254C,315C,362C,417C 'consumpt':81C 'contain':50B 'control':45B,224C,389C 'control-fram':44B,223C,388C 'craft':76B,113C 'crash':7A,64B,102C,298C 'cve':12A,15A 'decod':206C,294C,372C 'default':123C,154C,185C,272C,356C 'derefer':57B,296C 'desync':54B 'desynchron':292C 'document':258C 'dynam':263C,287C 'dynamic-t':286C 'enabl':121C 'enforc':33B,148C,191C,354C 'eovercrowd':400C 'error':418C 'everi':125C 'exceed':406C 'exhaust':10A 'fix':334C,349C 'flood':246C 'follow':351C 'frame':5A,46B,78B,115C,201C,225C,390C 'github.com':343C 'github.com/apache/brpc/pull/3474.':342C 'goaway':231C 'grew':252C 'grow':69B,106C 'grpc':22B 'h2':85C,119C,321C,379C,387C,397C 'h2/grpc':132C,313C 'header':40B,182C,200C,207C,279C,367C,382C 'headers/continuation':216C 'host':27B 'hpack':52B,194C,209C,262C 'http/2':4A,38B,77B,84C,114C 'http/h2/grpc':305C 'http2':23B 'ignor':399C 'index':195C 'instead':274C 'issu':290C 'let':164C 'limit':35B,142C,221C,352C,408C 'list':41B,183C,208C,368C,383C 'max':151C,181C,238C,357C,366C,381C,394C 'memori':11A,71B,108C,177C,219C 'mib':371C 'network':309C 'never':147C,159C,190C,214C 'never-complet':213C 'note':345C 'null':58B,297C 'number':170C 'old':403C 'packag':24B 'parser':120C,322C 'patch':340C 'path':87C 'peer':136C,166C 'pend':172C 'per':174C,361C,374C 'pin':167C 'ping':245C 'ping/settings':227C 'platform':95C 'port':128C,331C 'protocol':271C 'queue/accounting':289C 'read':251C 'receiv':86C,140C 'receive-sid':139C 'refer':196C 'refus':413C 'reject':410C 'remot':60B,98C 'request':405C 'resourc':80C 'respect':138C,392C 'restor':364C,377C,401C 'root':116C 'rst':229C,411C 'run':323C 'scenario':300C 'self':26B 'self-host':25B 'send':75B,112C 'serv':304C 'server':8A,67B,104C,127C,163C,303C 'set':150C,180C,278C 'share':330C 'side':141C 'size':42B,184C,265C,281C,369C,373C,384C 'small':199C 'socket':237C,393C 'stream':39B,153C,173C,230C,359C,375C,412C,414C 'tabl':53B,264C,280C,288C 'tcp':250C 'togeth':283C 'trust':134C 'unauthent':3A,61B,99C 'unbound':169C,205C 'uncondit':234C 'uncontrol':79C 'unlimit':156C,187C,365C,378C 'untrust':308C,318C 'unwritten':239C,395C 'updat':233C,266C 'upgrad':335C 'use':130C 'valid':268C 'version':30B,91C 'window':232C 'withheld':249C 'without':72B,109C,220C,256C 'write':47B,241C","nicknames":[],"mitigations":[],"who_affected":"Any bRPC server that serves HTTP, HTTP/2 or gRPC on a port reachable from an untrusted network is exposed, because the h2 parser runs before any Authenticator check on the shared port. bRPC h2/gRPC clients connecting to untrusted backends are also affected. Services only reachable on a trusted internal network with no h2 traffic from outside are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78058","severity":null,"published_at":"2026-10-21T12:17:23+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-78058","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78058","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}