CVE-2026-78669
EPSS 0.6%Vendor patching signals legitimacy, but grouped mass advisory, no KEV, no PoC, minimal EPSS suggest routine maintenance chatter.
What: HTTP/2 implementation flaw allowing excessive CPU consumption via malicious SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values; affects HTTP/2 clients and servers. CVSS unknown, EPSS 0.57%.
Why it matters: Google Apigee patching across multiple components (watcher, udca, redis, prometheus-adapter, cassandra-client, istiod) indicates vendor response. No KEV listing, no public PoC reported, no active exploitation signal. Low severity EPSS score suggests limited real-world threat.
Where it's seen: Bulk security advisory announcements on Bluesky listing CVE-2026-78669 alongside ~20 other CVEs across Apigee product line; appears to be routine patching communication rather than targeted security incident response.
RISK: LOW — HTTP/2 DoS requires attacker control of peer; EPSS 0.57% reflects minimal exploit probability.
Description
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.