Reachable Assertion Flaw in Apache bRPC's HTTP/2 Header Compression

CVE-2026-78048

What is CVE-2026-78048?

A reachable assertion flaw in the HPACK header-compression decoder within the HTTP/2 (h2/gRPC) stack of Apache bRPC versions prior to 1.18.0 allows remote attackers to crash the server process. This vulnerability arises when processing crafted HPACK headers, leading to a denial of service. The issue stems from an incorrect assumption in the dynamic-table ring buffer size calculation, permitting an untrusted peer to exploit the server's header processing capabilities. To mitigate this vulnerability, users should upgrade to bRPC version 1.18.0 or apply the relevant patch as recommended.

References