CVE-2026-54425 in bRPC
Summary
by MITRE • 10/22/2026
Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached.
Root Cause: The bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update. The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space.
Affected Scenarios: Use bRPC with the built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network.
How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3343
Note: The fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Apache bRPC prior to version 1.18.0 represents a critical implementation flaw within the HTTP/2 HPACK header compression and decompression library, specifically classified as an uncontrolled recursion issue. This defect allows remote attackers to trigger a denial of service condition by transmitting specially crafted HTTP/2 frames containing a high volume of consecutive Dynamic Table Size Update entries. The root cause lies in the design of the bRPC HPACK decoder, which processes these update instructions through recursive function calls rather than iterative loops. When the decoder encounters a Dynamic Table Size Update entry, it invokes itself to decode subsequent header fields or further updates without imposing any limit on the depth of recursion. This architectural choice fails to account for maliciously constructed inputs where an attacker supplies a long sequence of such entries, causing the application thread stack to be exhausted rapidly as each recursive call consumes additional memory space until the system runs out of available stack resources.
From a technical perspective, this flaw aligns with CWE-675, which describes operations that are not limited by bounded recursion depth. In the context of HTTP/2 communication, HPACK is used to compress header fields to reduce bandwidth usage and improve performance. However, when an untrusted network source sends malformed or maliciously crafted headers, the decoder's inability to bound its recursive calls leads directly to a stack overflow condition. This type of vulnerability falls under the ATT&CK technique T1499, Endpoint Denial of Service, as it enables an attacker to disrupt service availability by exhausting system resources without requiring authentication or elevated privileges on the target host. The impact is severe because HTTP/2 servers often handle multiple concurrent connections using thread-per-connection models; a single malicious connection can consume all stack space for that specific thread, potentially crashing the worker process and affecting other services running within the same application context if resource isolation is not strictly enforced at the operating system level.
The operational impact of this vulnerability extends beyond simple service interruption to potential instability in microservices architectures where bRPC is commonly deployed. Since HTTP/2 is widely adopted for high-performance internal communications, an attacker can exploit this flaw by sending a stream of Dynamic Table Size Update frames that force the decoder into deep recursion. Once the stack overflow occurs, the application thread terminates abruptly, leading to connection resets and potential cascading failures if load balancers or service meshes do not handle such errors gracefully. This creates a reliable vector for denial-of-service attacks against any system accepting HTTP/2 traffic from untrusted networks while utilizing the built-in bRPC implementation with default configurations that lack additional input validation layers.
To mitigate this risk, organizations must upgrade Apache bRPC to version 1.18.0 or later, where the HPACK decoder has been refactored to use iterative parsing instead of recursive decoding for Dynamic Table Size Update entries. This change ensures that processing these specific header updates does not consume additional stack frames per entry, thereby preventing stack exhaustion regardless of the number of consecutive update fields present in a request. Alternatively, if an immediate upgrade is not feasible, applying the patch provided via pull request 3343 on the Apache bRPC GitHub repository will resolve the issue by implementing bounds checking and iterative logic within the decoder loop. Additionally, deploying web application firewalls or reverse proxies that validate HTTP/2 header structures before they reach the backend service can provide an additional layer of defense against malformed input attacks targeting this specific vulnerability.