PatchSiren cyber security CVE debrief
CVE-2026-78048 Apache Software Foundation CVE debrief
A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of service. The vulnerability is caused by an incorrect calculation of the dynamic-table ring buffer size in the HPACK decoder, which can be triggered by a peer adding 121 minimal 33-byte entries without triggering eviction, hitting the CHECK(!_header_queue.full()) assertion and aborting the process. Defenders responsible for Apache bRPC servers serving HTTP/2 or gRPC requests from untrusted networks should assess
- Vendor
- Apache Software Foundation
- Product
- Apache bRPC
- CVSS
- Unknown
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-10-21
- Original CVE updated
- 2026-10-30
- Advisory published
- 2026-10-21
- Advisory updated
- 2026-10-30
Who should care
Defenders responsible for Apache bRPC servers serving HTTP/2 or gRPC requests from untrusted networks should assess the potential impact of this vulnerability and prioritize verifying exposure and remediation.
Why it matters
Defenders should prioritize verifying exposure of Apache bRPC servers serving HTTP/2 or gRPC requests from untrusted networks and assess the need for upgrading to version 1.18.0 or later to prevent potential denial of service attacks.
- Potential denial of service attacks against Apache bRPC servers
- Need for verification of exposure and remediation priority
- Potential impact on server availability and reliability
Technical summary
A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of service. The flaw is caused by an incorrect calculation of the dynamic-table ring buffer size in the HPACK decoder, which assumes a minimum table entry of 34 bytes instead of the actual minimum of 33 bytes specified in RFC 7541 section 4.1. This results in a reachable-assertion flaw that can be triggered by a peer adding 121 minimal 33-byte entries without triggering eviction
Defensive priority
Defenders should prioritize verifying exposure of Apache bRPC servers serving HTTP/2 or gRPC requests from untrusted networks and assess the need for upgrading to version 1.18.0 or later.
Recommended defensive actions
- Verify exposure of Apache bRPC servers serving HTTP/2 or gRPC requests from untrusted networks
- Assess the need for upgrading to version 1.18.0 or later
- Monitor for potential denial of service attacks
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Evidence notes
The CVE record and source item provide details on the vulnerability, including the affected version of Apache bRPC and the potential impact of a denial of service. The flaw is caused by an incorrect calculation of the dynamic-table ring buffer size in the HPACK decoder, which assumes a minimum table entry of 34 bytes instead of the actual minimum of 33 bytes specified in RFC 7541 section 4.1. This results in a reachable-assertion flaw that can be triggered by a remote attacker. Defenders should verify exposure of Apache bRPC servers
Sources and references
Verified primary and authoritative sources
-
CVE-2026-78048 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-78048
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-78048 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-78048
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
Unverified legacy reference
URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/78xxx/CVE-2026-78048.json
cve_program_cvelist_v5
-
Source reference
Unverified legacy reference
URL: https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb
Supplemental source - vendor-advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.