Denial of Service Vulnerability in Apache bRPC through HPACK Decoder

CVE-2026-54425

What is CVE-2026-54425?

An issue in the Apache bRPC library prior to version 1.18.0 involves uncontrolled recursion within the HTTP/2 HPACK decoder. This vulnerability allows remote attackers to trigger a denial of service by sending specially crafted HTTP/2 header blocks containing numerous consecutive Dynamic Table Size Update entries. The resulting recursive invocation of the HPACK decoder could lead to excessive stack consumption, potentially exhausting the thread stack and impacting service availability. Affected users should update to bRPC version 1.18.0 or apply the recommended patch to mitigate this risk.

References