CVE-2026-54425

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached. Root Cause: The bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update. The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space. Affected Scenarios: Use bRPC with the built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network. How to Fix: 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3343 Note: The fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing.

• CWE-674

• https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5442A heap buffer overflow vulnerability exists in the DICOM ima…9.8
• CVE-2026-54420LiteSpeed cPanel plugin before 2.4.8 (as distributed in Lite…8.5
• CVE-2026-54421In OpenStack Ironic before 37.0.1, when applying a PATCH to …6.8
• CVE-2026-54422In OpenStack Ironic Python Agent through 11.5.0, a malicious…5.5
• CVE-2026-54423In OpenStack Ironic before 37.0.1, an Ironic user with the a…8.2
• CVE-2026-54424An Incorrect Use of Privileged APIs vulnerability in Unity P…8.4
• CVE-2026-54426Uncontrolled recursion in the Redis reply parser in Apache b…7.5
• CVE-2026-54427Uncontrolled recursion in the AMF parser in Apache bRPC < 1.…7.5
• CVE-2026-54428Allocation of resources without limits or throttling in the …7.5
• CVE-2026-54429A vulnerability has been identified in SIMATIC S7-PLCSIM Adv…7.4
• CVE-2026-5443A heap buffer overflow vulnerability exists during the decod…9.8
• CVE-2026-54430liboauth2 is vulnerable to Server-Side Request Forgery in oa…5.1