CVE-2026-54425

Deferred Deferred - Pending Action

Stack Overflow in HTTP/2 HPACK Decoder of Apache bRPC

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached. Root Cause: The bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update. The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space. Affected Scenarios: Use bRPC with the built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3343 Note: The fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-54425

EUVD

EUVD-2026-107169

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled recursion flaw in the HTTP/2 HPACK decoder of Apache bRPC before version 1.18.0. It allows remote attackers to cause a denial of service by sending crafted HTTP/2 headers with many consecutive Dynamic Table Size Update entries. The decoder processes these entries recursively without depth limits, exhausting thread stack space before reaching a header field or end of input.

Detection Guidance

Detecting this vulnerability requires monitoring for excessive recursion or stack exhaustion in bRPC HTTP/2 HPACK decoder processes. Check for crashes or hangs in bRPC services handling HTTP/2 traffic. Monitor logs for errors related to stack overflow or recursion depth limits.

Impact Analysis

If you use bRPC with its built-in HTTP/2 implementation to accept traffic from untrusted networks, this flaw could crash your application by consuming excessive stack space. This results in a denial of service, making the service unavailable to legitimate users.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a denial-of-service issue in Apache bRPC's HTTP/2 HPACK decoder that could disrupt service availability but does not involve data breaches or unauthorized access.

Mitigation Strategies

Upgrade bRPC to version 1.18.0 or later to resolve the issue.
Apply the patch from https://github.com/apache/brpc/pull/3343 if upgrading is not immediately possible.
Restrict HTTP/2 traffic to trusted sources until mitigation is applied.

Hi! I’m here to help you understand CVE-2026-54425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...