Threats tagged 'ghsa-95vv-8ch6-6f8f'

Apache bRPC versions before 1.18.0 contain an uncontrolled recursion vulnerability in the HTTP/2 HPACK decoder. Remote attackers can exploit this by sending a crafted HTTP/2 header block with many consecutive Dynamic Table Size Update entries, causing a denial of service via stack exhaustion. The issue arises because the decoder recursively processes each update without bounding recursion depth. The vulnerability is fixed in version 1.18.0 by changing the decoder to use iterative parsing.