CVE-2026-78048: CWE-617 Reachable Assertion in Apache Software Foundation Apache bRPC

The vulnerability exists in Apache bRPC's HPACK header-compression decoder used in HTTP/2 and gRPC protocols. The root cause is an off-by-one error in the calculation of the dynamic-table ring buffer size in src/brpc/details/hpack.cpp, where the code assumes a minimum table entry size of 34 bytes instead of the RFC 7541 specified 33 bytes. This miscalculation allows an attacker to send 121 minimal 33-byte entries without triggering eviction, leading to a CHECK assertion failure (_header_queue.full()) that aborts the server process. This results in a denial of service by crashing the server. The issue affects all platforms running Apache bRPC versions prior to 1.18.0. The vulnerability can be triggered remotely by sending crafted HPACK headers in HTTP/2 or gRPC requests from untrusted networks without authentication. The fix involves correcting the dynamic table sizing to use the correct minimum entry size and ensuring proper ring-buffer slot allocation. The issue is resolved in Apache bRPC version 1.18.0 or by applying the patch available at https://github.com/apache/brpc/pull/3462.

A remote attacker can cause a denial of service by crashing the Apache bRPC server process through sending specially crafted HPACK headers in HTTP/2 or gRPC requests. This disrupts service availability but does not indicate code execution or data compromise based on the provided information.

Upgrade Apache bRPC to version 1.18.0, which includes the official fix for this vulnerability. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3462 that corrects the dynamic table sizing and prevents the assertion failure. No other mitigation steps are indicated or required according to the vendor advisory.