Skip to content
VulniPulse
Sign in
Advisory severityUnratedApache Software Foundation Updated

Advisory [CVE-2026-54425] Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries

This security Apache Software Foundation advisory covers CVE-2026-54425; related products: Apache bRPC.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-54425 Source published Source updated

VulniPulse record published Record updated

CVE-2026-54425
Related products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries.

Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached.

Root Cause: The bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update.

The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space.

Affected Scenarios: Use bRPC with the built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network.

How to Fix: 1.

Upgrade bRPC to version 1.18.0, which fixes this issue. 2.

Apply this patch:

Note: The fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing.

Affected versions
  • Apache bRPC before 1.18.0

Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source

Fixed versions
  • 1.18.0

Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached.
  • Root Cause: The bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update.
  • The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space.
  • Upgrade bRPC to version 1.18.0, which fixes this issue.
  • Apply this patch: https://github.com/apache/brpc/pull/3343 Note: The fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing.
Temporary workarounds
  • Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries.

Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.