CVE-2026-54425: CWE-674 Uncontrolled Recursion in Apache Software Foundation Apache bRPC

CVE-2026-54425 describes an uncontrolled recursion vulnerability in the HTTP/2 HPACK decoder of Apache bRPC before version 1.18.0. The vulnerability arises because the decoder recursively processes each Dynamic Table Size Update entry without bounding recursion depth. An attacker can exploit this by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries, causing the decoder to exhaust the thread stack and crash, resulting in denial of service. The root cause is the recursive decoding approach that lacks limits on recursion depth. The issue is resolved in Apache bRPC 1.18.0 by switching to iterative parsing for these entries.

Remote attackers can cause a denial of service on affected Apache bRPC servers by sending specially crafted HTTP/2 header blocks that trigger uncontrolled recursion in the HPACK decoder, leading to thread stack exhaustion and service crashes. This impacts availability of the service processing HTTP/2 traffic using bRPC versions prior to 1.18.0.

Upgrade Apache bRPC to version 1.18.0 or later, which contains an official fix that replaces recursive HPACK Dynamic Table Size Update decoding with iterative parsing. Applying this update fully mitigates the vulnerability. No other mitigation is indicated or required.