{"id":"CVE-2026-56386","title":"Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser","summary":"Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-len…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"adp","cwe":["CWE-191","CWE-125"],"vendor":"Apache Software Foundation","product":"apache/brpc","affected":["apache/brpc < 1.18.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-21T13:07:50.344384Z"},"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T13:07:53.942Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-56386","references":[{"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T12:48:53.765Z","slug":"CVE-2026-56386","body":"## Overview\n\nInteger underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.\n\nRoot Cause:\nThe HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer.\n\nAffected Scenarios:\nApache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch:  https://github.com/apache/brpc/pull/3325 \n\nNote:\nThe fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.\n\n## Affected\n\n- `apache/brpc < 1.18.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":227240,"id":"CVE-2026-56386","ts":1792591060124,"field":"cvss","old":null,"new":"7.5"},{"seq":227239,"id":"CVE-2026-56386","ts":1792591060124,"field":"severity","old":"none","new":"high"}]}