147264 matches found
CVE-2026-78058
Apache bRPC (version
EUVD-2026-107183
A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 h2/gRPC stack in Apache bRPC version = 1 byte + value = 1 byte + 32 bytes of overhead. However, RFC 7541 section 4.1 specifies that the minimum entry size is 33 bytes, because the value may be empty name = 1 byte +...
CVE-2026-78048 Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 h2/gRPC stack in Apache bRPC version = 1 byte + value = 1 byte + 32 bytes of overhead. However, RFC 7541 section 4.1 specifies that the minimum entry size is 33 bytes, because the value may be empty name = 1 byte +...
CVE-2026-78048
Apache bRPC versions prior to 1.18.0 are vulnerable to a Remote Denial of Service (DoS) via a reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack. The root cause is located in src/brpc/details/hpack.cpp, where the IndexTable::Init function incorrectly as...
Exposure Of Sensitive Information
A2A Java SDK is vulnerable to Exposure of Sensitive Information. The vulnerability is due to improper redirect handling in the Android HTTP client's synchronous POST requests, which allows an attacker controlling a redirected destination to obtain configured API keys or authentication tokens...
CVE-2026-61902 Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
Apache bRPC versions before 1.18.0 do not consistently enforce the configured maxbodysize limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured...
EUVD-2026-107176
Apache bRPC versions before 1.18.0 do not consistently enforce the configured maxbodysize limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured...
CVE-2026-61902
Apache bRPC versions before 1.18.0 are vulnerable to memory exhaustion and denial of service because they do not consistently enforce the max_body_size limit during non-progressive HTTP/1 and HTTP/2 parsing, as well as memcache and couchbase response parsing. A remote unauthenticated peer can tri...
CVE-2026-56386
The Apache bRPC HTTP/2 server DATA frame parser is vulnerable to an integer underflow and out-of-bounds read . The issue arises because the handler decrements the fragment size when the PADDED flag is set before verifying the presence of the mandatory pad length byte. An unauthenticated remote at...
CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...
EUVD-2026-107172
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...
CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...
nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests
A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...
CVE-2026-54425 Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK...
EUVD-2026-107169
Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded by recursively invoking the HPACK...
CVE-2026-54425
Apache bRPC versions before 1.18.0 are vulnerable to a denial of service (DoS) due to uncontrolled recursion (CWE-674) in the HTTP/2 HPACK decoder. An attacker can send a crafted HTTP/2 header block with many consecutive Dynamic Table Size Update entries, causing the decoder to exhaust the thread...
CVE-2026-48830 Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...
CVE-2026-48830
Apache bRPC versions through 1.17.0 are vulnerable to an improper authentication flaw (CWE-287 ). If ServerOptions.auth is enabled and builtin HTTP services are exposed, an unauthenticated remote attacker can send a builtin HTTP request as the first message on an HTTP/1.1 keep-alive connection. T...
EUVD-2026-107168
Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...
