CVE-2026-56386: CWE-191 Integer Underflow in Apache Software Foundation Apache bRPC
Description
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer. Affected Scenarios: Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation. How to Fix: (Choose one of the following options) 1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3325 Note: The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR.
CVSS v3.1
Score 7.5high
Affected software
Apache Software Foundation
Apache bRPC
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
An integer underflow and out-of-bounds read occur in the HTTP/2 server DATA frame parser of Apache bRPC when processing a padded DATA frame with a zero-length payload. The vulnerability is due to decrementing the fragment size before confirming the frame contains the required pad length byte, allowing an attacker to cause a denial of service by sending a malformed frame. The flaw affects Apache bRPC servers that accept HTTP/2 traffic via cleartext h2c or TLS ALPN negotiation. The issue is resolved by validating the padded DATA frame payload length before decrementing the fragment size or reading the pad length byte. Malformed frames are rejected with an HTTP/2 FRAME_SIZE_ERROR. The fix is included in Apache bRPC version 1.18.0 or can be applied via a specific patch.
Potential Impact
An unauthenticated remote attacker can cause a denial of service on affected Apache bRPC servers by sending a specially crafted HTTP/2 DATA frame with the PADDED flag set and a zero-length payload. This triggers an integer underflow and out-of-bounds read in the frame parser, leading to server instability or crash. No information about remote code execution or data disclosure is provided.
Mitigation Recommendations
Upgrade Apache bRPC to version 1.18.0, which contains the official fix for this vulnerability. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3325. The fix ensures that padded DATA frames have sufficient payload bytes before decrementing the fragment size or reading the pad length byte, rejecting malformed frames with an HTTP/2 FRAME_SIZE_ERROR.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-06-21T04:43:24.873Z
- State
- PUBLISHED
Threat ID: 6ad8a6b32cdf04f656e8130d
Added to database: 10/21/2026, 11:49:07 UTC
Last enriched: 10/21/2026, 12:04:37 UTC
Last updated: 10/21/2026, 13:46:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.