Uncontrolled Resource Consumption in Apache bRPC for HTTP/2 Protocol

CVE-2026-78058

What is CVE-2026-78058?

The bRPC framework in Apache displays a significant vulnerability in its HTTP/2 (h2) receive path. By exploiting design flaws in the h2 parser, an unauthenticated remote attacker can manipulate memory consumption and potentially crash the server. This occurs due to an absence of enforced limits on concurrent streams and header sizes, leading to excessive memory usage and instability. The flaw can occur on any bRPC server interacting with untrusted networks, as the parser’s operations precede the implementation of authentication checks. Mitigation requires upgrading bRPC or applying specific patches to enforce strict resource limits and safeguard against potential attacks.

References