CVE-2026-78058: Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames.
Root Cause: The h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clients, trusts the peer to respect receive-side limits that bRPC advertises but never enforces: 1. SETTINGSMAXCONCURRENTSTREAMS defaulted to unlimited and was never checked on the server, letting a peer pin an unbounded number of pending streams per connection (~100x memory amplification). 2. SETTINGSMAXHEADERLISTSIZE defaulted to unlimited and was never enforced; 1-byte HPACK indexed references amplify a small HEADERS frame ~4000x into an unbounded decoded header list ("HPACK bomb"), and a never-completed HEADERS/CONTINUATION block accumulates memory without limit. 3. Control-frame acks (PING/SETTINGS acks, RSTSTREAM, GOAWAY, WINDOWUPDATE) unconditionally bypassed the -socketmaxunwrittenbytes write cap, so a PING flood combined with withheld TCP reads grew the connection buffer without the documented bound. 4. The HPACK dynamic table size update was validated against the protocol default (4096) instead of the advertised SETTINGSHEADERTABLESIZE, which together with the dynamic-table queue/accounting issue can desynchronize the decoder and dereference NULL (crash).
Affected scenarios: Any bRPC server serving HTTP/h2/gRPC to an untrusted network, and any bRPC h2/gRPC client connecting to an untrusted backend. The h2 parser runs before any Authenticator check on the shared port.
How to fix: Upgrade bRPC, or apply the patch in https://github.com/apache/brpc/pull/3474.
Note: After applying the fix the following limits are enforced by default: - maxconcurrentstreams: 1024 per connection (4294967295 restores unlimited). - maxheaderlistsize: 1 MiB decoded size per stream (4294967295 restores unlimited; -h2clientmaxheaderlistsize for clients). - h2 control-frame acks respect -socketmaxunwrittenbytes (-h2ackignoreeovercrowded restores the old behavior). Requests exceeding these limits are rejected (RSTSTREAM(REFUSEDSTREAM) or a connection error).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Apache bRPC servers earlier than 1.18.0 are affected on all platforms. HTTP/2 parsing is enabled by default on every bRPC server port, including for h2 and gRPC clients.
Does exploitation require authentication or an existing application-level session?
No. A remote unauthenticated attacker can trigger the issue by sending crafted HTTP/2 frames to the server.
What conditions make memory exhaustion more likely?
An attacker can retain an unbounded number of pending streams, inflate decoded headers through HPACK indexed references, leave a HEADERS/CONTINUATION block incomplete, or flood control-frame acknowledgements while withholding TCP reads. These paths can grow memory or connection write buffers without the intended limits.
How can I determine whether a server is affected?
Check whether the deployed Apache bRPC version is earlier than 1.18.0. Because HTTP/2 is enabled by default on bRPC server ports, an exposed server port should be treated as affected unless it is running 1.18.0 or later.