{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-78058 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-78058 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-78058 is a vulnerability in Apache bRPC, published on 21 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-78058 and fix it if it is affected.\n\nWhat it is: CVE-2026-78058 is a vulnerability in Apache bRPC, published on 21 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-78058 in the wild and no public exploit code.\n\nAffected product: Apache bRPC. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-78058/ (Markdown: https://insights.sbomify.com/CVE-2026-78058/index.md)","id":"CVE-2026-78058","markdown":"https://insights.sbomify.com/CVE-2026-78058/index.md","name":"CVE-2026-78058","record":{"aliases":["GHSA-cvqv-jpx4-mgc8"],"analysis":null,"analysis_generated_by":null,"assigner":"apache","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"},{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version \u003c 1.18.0) on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames.\n\nRoot Cause:\nThe h2 parser, enabled by default on every bRPC server port and used by h2/gRPC clients, trusts the peer to respect receive-side limits that bRPC advertises but never enforces:\n1. SETTINGS_MAX_CONCURRENT_STREAMS defaulted to unlimited and was never checked on the server, letting a peer pin an unbounded number of pending streams per connection (~100x memory amplification).\n2. SETTINGS_MAX_HEADER_LIST_SIZE defaulted to unlimited and was never enforced; 1-byte HPACK indexed references amplify a small HEADERS frame ~4000x into an unbounded decoded header list (\"HPACK bomb\"), and a never-completed HEADERS/CONTINUATION block accumulates memory without limit.\n3. Control-frame acks (PING/SETTINGS acks, RST_STREAM, GOAWAY, WINDOW_UPDATE) unconditionally bypassed the -socket_max_unwritten_bytes write cap, so a PING flood combined with withheld TCP reads grew the connection buffer without the documented bound.\n4. The HPACK dynamic table size update was validated against the protocol default (4096) instead of the advertised SETTINGS_HEADER_TABLE_SIZE, which together with the dynamic-table queue/accounting issue can desynchronize the decoder and dereference NULL (crash).\n\nAffected scenarios:\nAny bRPC server serving HTTP/h2/gRPC to an untrusted network, and any bRPC h2/gRPC client connecting to an untrusted backend. The h2 parser runs before any Authenticator check on the shared port.\n\nHow to fix: \nUpgrade bRPC, or apply the patch in https://github.com/apache/brpc/pull/3474.\n\nNote:\nAfter applying the fix the following limits are enforced by default:\n- max_concurrent_streams: 1024 per connection (4294967295 restores unlimited).\n- max_header_list_size: 1 MiB decoded size per stream (4294967295 restores unlimited; -h2_client_max_header_list_size for clients).\n- h2 control-frame acks respect -socket_max_unwritten_bytes (-h2_ack_ignore_eovercrowded restores the old behavior).\nRequests exceeding these limits are rejected (RST_STREAM(REFUSED_STREAM) or a connection error).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path","id":"CVE-2026-78058","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"SourceCodester Stock Management System printOrder.php cross site scripting","id":"CVE-2026-78059"},"packages":[],"prev":{"headline":"sambitraj Student-Management-System Management Mutation sql injection","id":"CVE-2026-78057"},"products":["Apache bRPC"],"published":"2026-10-21","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Apache Software Foundation"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-78058/"}