CVE-2026-54425

{
  "id": "CVE-2026-54425",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-21T12:17:21.053",
  "lastModified": "2026-10-30T14:17:05.960",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK decoder, which could exhaust the thread stack before a header field or end of input was reached.\n\nRoot Cause:\nThe bRPC HPACK decoder recursively decoded the next entry after processing a Dynamic Table Size Update. The decoder did not bound the recursion depth, so a long sequence of update entries could consume excessive stack space.\n\nAffected Scenarios:\nUse bRPC with the built-in HTTP/2 implementation to accept HTTP/2 traffic from an untrusted network.\n\nHow to Fix:\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3343 \n\nNote:\nThe fix changes HPACK Dynamic Table Size Update decoding to use iterative parsing instead of recursive parsing."
    },
    {
      "lang": "es",
      "value": "Recursión no controlada en el decodificador HPACK de HTTP/2 de Apache bRPC antes de la versión 1.18.0 permite a atacantes remotos provocar una denegación de servicio enviando un bloque de encabezados HTTP/2 manipulado que contiene muchas entradas consecutivas de Actualización del tamaño de la tabla dinámica. Cada actualización se decodificaba invocando recursivamente el decodificador HPACK, lo que podía agotar la pila del hilo antes de que se alcanzara un campo de encabezado o el final de la entrada.\\n\\nCausa raíz:\\nEl decodificador HPACK de bRPC decodificaba recursivamente la siguiente entrada después de procesar una Actualización del tamaño de la tabla dinámica. El decodificador no limitaba la profundidad de la recursión, de modo que una larga secuencia de entradas de actualización podía consumir un espacio de pila excesivo.\\n\\nEscenarios afectados:\\nUso de bRPC con la implementación integrada de HTTP/2 para aceptar tráfico HTTP/2 desde una red no confiable.\\n\\nCómo solucionar:\\n1. Actualice bRPC a la versión 1.18.0, que corrige este problema.  \\n2. Aplique este parche: https://github.com/apache/brpc/pull/3343\\n\\nNota:\\nLa corrección modifica la decodificación de Actualizaciones del tamaño de la tabla dinámica de HPACK para usar un análisis iterativo en lugar de recursivo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache bRPC",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "apache/brpc",
          "packageURL": "pkg:github/apache/brpc",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.18.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-30T13:45:42.813783Z",
          "id": "CVE-2026-54425",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb",
      "source": "[email protected]"
    }
  ]
}