VulnTideExploited vulnerabilities, by vendor. Data as of .
Not in CISA KEVPublished EPSS 0.3% probability of exploitation in 30 daysFound by AI: Anthropic (Claude)
Apache

CVE-2026-78058: Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path

Is it exploited?

Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.

How likely is exploitation in the next 30 days?
0.3%

EPSS score, percentile 23.5 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?
Not scored

The CVE record carries no CVSS score.

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (1)

Which versions are affected?

Affected

  • before 1.18.0

Versions by product

Source: CISA KEV 2026.10.29, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.

What to do

Advisories and patches

This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

As listed in the CVE record.

Apache Software Foundation Apache bRPC
StatusVersions
Affectedbefore 1.18.0

Versions not listed are: unaffected.

Source: CVE List, as of . About the data.

About this vulnerability

Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clients, trusts the peer to respect receive-side limits that…

Summary: CVE record, as of .

  • CISA has not added CVE-2026-78058 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
  • The CVE record was published on 21 Oct 2026.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.3% (percentile 23.5), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
  • The credits in the CVE record name Anthropic (Claude) as finder.

Source: CISA KEV 2026.10.29, as of ; CVE List, as of ; FIRST EPSS, as of . About the data.

Description

Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path

Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clients, trusts the peer to respect receive-side limits that bRPC advertises but never enforces: 1. SETTINGS_MAX_CONCURRENT_STREAMS defaulted to unlimited and was never checked on the server, letting a peer pin an unbounded number of pending streams per connection (~100x memory amplification). 2. SETTINGS_MAX_HEADER_LIST_SIZE defaulted to unlimited and was never enforced; 1-byte HPACK indexed references amplify a small HEADERS frame ~4000x into an unbounded decoded header list ("HPACK bomb"), and a never-completed HEADERS/CONTINUATION block accumulates memory without limit. 3. Control-frame acks (PING/SETTINGS acks, RST_STREAM, GOAWAY, WINDOW_UPDATE) unconditionally bypassed the -socket_max_unwritten_bytes write cap, so a PING flood combined with withheld TCP reads grew the connection buffer without the documented bound. 4. The HPACK dynamic table size update was validated against the protocol default (4096) instead of the advertised SETTINGS_HEADER_TABLE_SIZE, which together with the dynamic-table queue/accounting issue can desynchronize the decoder and dereference NULL (crash). Affected scenarios: Any bRPC server serving HTTP/h2/gRPC to an untrusted network, and any bRPC h2/gRPC client connecting to an untrusted backend. The h2 parser runs before any Authenticator check on the shared port. How to fix: Upgrade bRPC, or apply the patch in https://github.com/apache/brpc/pull/3474. Note: After applying the fix the following limits are enforced by default: - max_concurrent_streams: 1024 per connection (4294967295 restores unlimited). - max_header_list_size: 1 MiB decoded size per stream (4294967295 restores unlimited; -h2_client_max_header_list_size for clients). - h2 control-frame acks respect -socket_max_unwritten_bytes (-h2_ack_ignore_eovercrowded restores the old behavior). Requests exceeding these limits are rejected (RST_STREAM(REFUSED_STREAM) or a connection error).

Source: CVE List, as of . About the data.

Weakness

CWE-400, CWE-476
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-476: NULL Pointer Dereference

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

DateEvent
CVE record published

Known exploited Apache vulnerabilities

  • CVE-2016-3081: Apache Struts Command Injection Vulnerability (added )
  • CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (added )
  • CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability (added )
  • CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability (added )
  • CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability (added )